CVE-2018-14553

gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a NULL pointer dereference allowing attackers to crash an application via a specific function call sequence. Only affects PHP when linked with an external libgd (not bundled).

gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a NULL pointer dereference allowing attackers to crash an application via a specific function call sequence. Only affects PHP when linked with an external libgd (not bundled).

GD is an open source code library for the dynamic creation of images by programmers. GD creates PNG, JPEG, GIF, WebP, XPM, BMP images, among other formats.

Security Fix(es):

• gd: Heap-based buffer overflow in gdImageColorMatch() in gd_color_match.c (CVE-2019-6977)

• gd: NULL pointer dereference in gdImageClone (CVE-2018-14553)

• gd: Double free in the gdImage*Ptr in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c (CVE-2019-6978)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.

gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a NULL pointer dereference allowing attackers to crash an application via a specific function call sequence. Only affects PHP when linked with an external libgd (not bundled).

GD is an open source code library for the dynamic creation of images by programmers. GD creates PNG, JPEG, GIF, WebP, XPM, BMP images, among other formats.

Security Fix(es):

• gd: Heap-based buffer overflow in gdImageColorMatch() in gd_color_match.c (CVE-2019-6977)

• gd: NULL pointer dereference in gdImageClone (CVE-2018-14553)

• gd: Double free in the gdImage*Ptr in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c (CVE-2019-6978)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The updated packages fix a security vulnerability:

gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a NULL pointer dereference allowing attackers to crash an application via a specific function call sequence. (CVE-2018-14553)

This update for gd fixes the following issues:

Security issue fixed:

• CVE-2018-14553: Fixed a null pointer dereference in gdImageClone (bsc#1165471).
• CVE-2019-11038: Fixed a information disclosure in gdImageCreateFromXbm() (bsc#1140120).

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the gd-2.3.3-1.1 package on the GA media of openSUSE Tumbleweed.

This update for gd fixes the following issues:

Security issue fixed:

• CVE-2018-14553: Fixed a null pointer dereference in gdImageClone (bsc#1165471).
• CVE-2019-11038: Fixed a information disclosure in gdImageCreateFromXbm() (bsc#1140120).

This update for gd fixes the following issues:

Security issue fixed:

• CVE-2018-14553: Fixed a null pointer dereference in gdImageClone (bsc#1165471).
• CVE-2019-11038: Fixed a information disclosure in gdImageCreateFromXbm() (bsc#1140120).

This update for gd fixes the following issues:

• CVE-2017-7890: Fixed a buffer over-read into uninitialized memory (bsc#1050241).
• CVE-2018-14553: Fixed a null pointer dereference in gdImageClone() (bsc#1165471).
• CVE-2019-11038: Fixed a information disclosure in gdImageCreateFromXbm() (bsc#1140120).

It was discovered that GD Graphics Library incorrectly handled cloning an image. An attacker could possibly use this issue to cause GD Graphics Library to crash, resulting in a denial of service. (CVE-2018-14553)

It was discovered that GD Graphics Library incorrectly handled loading images from X bitmap format files. An attacker could possibly use this issue to cause GD Graphics Library to crash, resulting in a denial of service, or to disclose contents of the stack that has been left there by previous code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 16.04 LTS. (CVE-2019-11038)

USN-4316-1 fixed a vulnerability in GD Graphics Library. This update provides the corresponding update for Ubuntu 14.04 ESM.

Original advisory details:

It was discovered that GD Graphics Library incorrectly handled cloning an image. An attacker could possibly use this issue to cause GD Graphics Library to crash, resulting in a denial of service. (CVE-2018-14553)

It was discovered that GD Graphics Library incorrectly handled loading images from X bitmap format files. An attacker could possibly use this issue to cause GD Graphics Library to crash, resulting in a denial of service, or to disclose contents of the stack that has been left there by previous code. (CVE-2019-11038)