Double-Free Vulnerability in libgd2
Summary
DLA-1106-1: libgd2 - security update. Affects libgd2 versions < 2.0.36~rc1~dfsg-6.1+deb7u10. Fixed in 2.0.36~rc1~dfsg-6.1+deb7u10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libgd2 is a library for programmatic graphics creation and manipulation. It provides functions for image creation, drawing, and manipulation. The library is widely used in various applications and frameworks for generating and manipulating images. However, a double-free vulnerability has been discovered in the gdImagePngPtr() function of libgd2. This vulnerability can be exploited by processing a specially crafted file, potentially leading to denial of service or arbitrary code execution.
Vulnerability Detail
The double-free vulnerability in libgd2 occurs in the gdImagePngPtr() function. When processing a PNG file, the function fails to properly handle certain conditions, resulting in a double-free of a memory object. An attacker can exploit this vulnerability by providing a specially crafted PNG file, which, when processed by an application using libgd2, can lead to a denial of service or potentially execute arbitrary code. This vulnerability poses a significant risk to applications that utilize libgd2 for image processing.
How To Fix
Minimum fixed version
2.0.36~rc1~dfsg-6.1+deb7u10
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libgd2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading the libgd2 package to the patched version.
Conclusion
The double-free vulnerability in libgd2 can lead to denial of service or arbitrary code execution if a specially crafted file is processed. It is crucial to upgrade the libgd2 package to the patched version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libgd2 →
FAQ
libgd2 is a library for programmatic graphics creation and manipulation. It provides functions for image creation, drawing, and manipulation.
The vulnerability in libgd2 can result in denial of service or potentially the execution of arbitrary code if a specially crafted file is processed.
An attacker can exploit this vulnerability by providing a specially crafted PNG file, which, when processed by an application using libgd2, can lead to a denial of service or potentially execute arbitrary code.
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading the libgd2 package to the patched version.
To fix this vulnerability, it is recommended to upgrade the libgd2 package to version 2.0.36~rc1~dfsg-6.1+deb7u10 or later. This version includes the necessary patches to address the double-free vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for libgd2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
