Security Update for libgd2
Summary
DLA-1055-1: libgd2 - security update. Affects libgd2 versions < 2.0.36~rc1~dfsg-6.1+deb7u9. Fixed in 2.0.36~rc1~dfsg-6.1+deb7u9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libgd2 is a library for programmatic graphics creation and manipulation. It provides functions for loading, creating, and manipulating images in various formats. The library is widely used in applications that require image processing and rendering capabilities.
Vulnerability Detail
The vulnerability (CVE-2017-7890) in libgd2 is related to the gdImageCreateFromGifCtx() function, which is used to load images from GIF format files. The function fails to zero stack allocated color map buffers before their use, potentially leading to information disclosure. An attacker could exploit this vulnerability by providing a specially crafted GIF file, which, when processed by an application using libgd2, could disclose sensitive information.
How To Fix
Minimum fixed version
2.0.36~rc1~dfsg-6.1+deb7u9
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libgd2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in libgd2 could potentially lead to information disclosure if a specially crafted GIF file is processed. It is recommended to upgrade the libgd2 package to the latest version to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for libgd2 →
FAQ
libgd2 is a library for programmatic graphics creation and manipulation, commonly used in applications that require image processing capabilities.
The vulnerability in libgd2 could potentially lead to information disclosure if a specially crafted GIF file is processed. This could expose sensitive data to an attacker.
To fix this vulnerability, it is recommended to upgrade the libgd2 package to version 2.0.36~rc1~dfsg-6.1+deb7u9 or later. Detailed instructions can be found in the Debian LTS security advisories.
No specific workaround has been mentioned for this vulnerability.
More information about Debian LTS security advisories, including how to apply updates and frequently asked questions, can be found at the Debian LTS wiki.
Related vulnerabilities
Recent vulnerabilities recorded for libgd2.
