CVE-2007-3476
Array index error in gd_gif_in.c in the GD Graphics Library (libgd) before 2.0.35 allows user...
CVE-2007-3476 is a medium vulnerability (CVSS 4.3) in Gd Graphics Library Gdlib, published June 28, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.46%, the 84th percentile. Fixed in libgd2 2.0.35.dfsg-1.
Array index error in gd_gif_in.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash and heap corruption) via large color index values in crafted image data, which results in a segmentation fault.
Exploit likelihood
What each source reports
NVD Score used
Array index error in gd_gif_in.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash and heap corruption) via large color index values in crafted image data, which results in a segmentation fault.
- Record
CVE-2007-3476- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE List No score
Array index error in gd_gif_in.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash and heap corruption) via large color index values in crafted image data, which results in a segmentation fault.
- Record
CVE-2007-3476- Updated
- 2026-11-02
EUVDEUVD-2007-3461 No score
Array index error in gd_gif_in.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash and heap corruption) via large color index values in crafted image data, which results in a segmentation fault.
- Record
EUVD-2007-3461- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3mpq-f59x-83gx No score
Array index error in gd_gif_in.c in the GD Graphics Library (libgd) before 2.0.35 allows user...
Array index error in gd_gif_in.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash and heap corruption) via large color index values in crafted image data, which results in a segmentation fault.
- Record
GHSA-3mpq-f59x-83gx- Updated
- 2026-11-02
OSV No score
Array index error in gd_gif_in.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash and heap corruption) via large color index values in crafted image data, which results in a segmentation fault.
- Record
CVE-2007-3476- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-3476 No score
Array index error in gd_gif_in.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash and heap corruption) via large color index values in crafted image data, which results in a segmentation fault.
- Record
DEBIAN-CVE-2007-3476- Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2007-3476 No score
CVE-2007-3476 in libwmf - Patched by Root
Root has patched CVE-2007-3476 in the libwmf package for Root:Debian:12. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-12-CVE-2007-3476- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libgd2Debian:12 |
before 2.0.35.dfsg-1 | 2.0.35.dfsg-1 |
libgd2Debian:13 |
before 2.0.35.dfsg-1 | 2.0.35.dfsg-1 |
libgd2Debian:14 |
before 2.0.35.dfsg-1 | 2.0.35.dfsg-1 |
libwmfDebian:12 |
All versions, plus listed versions 0.2.12-5.10.2.12-5.20.2.13-10.2.13-1.10.2.13-20.2.14-1 |
None known |
libwmfDebian:13 |
All versions, plus listed versions 0.2.13-1.10.2.13-20.2.14-1 |
None known |
libwmfDebian:14 |
All versions, plus listed versions 0.2.13-1.10.2.13-20.2.14-1 |
None known |
racketDebian:12 |
before 5.0.2-1 | 5.0.2-1 |
racketDebian:13 |
before 5.0.2-1 | 5.0.2-1 |
racketDebian:14 |
before 5.0.2-1 | 5.0.2-1 |
libgd2Debian:4.0 |
before 2.0.33-5.2etch1, plus listed versions 2.0.33-5.2 |
2.0.33-5.2etch1 |
Show 28 moreShow less
| Package | Affected | Fixed |
|---|---|---|
gdRed Hat:enterprise_linux:4::as |
before 0:2.0.28-5.4E.el4_6.1 | 0:2.0.28-5.4E.el4_6.1 |
gd-debuginfoRed Hat:enterprise_linux:4::as |
before 0:2.0.28-5.4E.el4_6.1 | 0:2.0.28-5.4E.el4_6.1 |
gd-develRed Hat:enterprise_linux:4::as |
before 0:2.0.28-5.4E.el4_6.1 | 0:2.0.28-5.4E.el4_6.1 |
gd-progsRed Hat:enterprise_linux:4::as |
before 0:2.0.28-5.4E.el4_6.1 | 0:2.0.28-5.4E.el4_6.1 |
gdRed Hat:enterprise_linux:4::desktop |
before 0:2.0.28-5.4E.el4_6.1 | 0:2.0.28-5.4E.el4_6.1 |
gd-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:2.0.28-5.4E.el4_6.1 | 0:2.0.28-5.4E.el4_6.1 |
gd-develRed Hat:enterprise_linux:4::desktop |
before 0:2.0.28-5.4E.el4_6.1 | 0:2.0.28-5.4E.el4_6.1 |
gd-progsRed Hat:enterprise_linux:4::desktop |
before 0:2.0.28-5.4E.el4_6.1 | 0:2.0.28-5.4E.el4_6.1 |
gdRed Hat:enterprise_linux:4::es |
before 0:2.0.28-5.4E.el4_6.1 | 0:2.0.28-5.4E.el4_6.1 |
gd-debuginfoRed Hat:enterprise_linux:4::es |
before 0:2.0.28-5.4E.el4_6.1 | 0:2.0.28-5.4E.el4_6.1 |
gd-develRed Hat:enterprise_linux:4::es |
before 0:2.0.28-5.4E.el4_6.1 | 0:2.0.28-5.4E.el4_6.1 |
gd-progsRed Hat:enterprise_linux:4::es |
before 0:2.0.28-5.4E.el4_6.1 | 0:2.0.28-5.4E.el4_6.1 |
gdRed Hat:enterprise_linux:4::ws |
before 0:2.0.28-5.4E.el4_6.1 | 0:2.0.28-5.4E.el4_6.1 |
gd-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:2.0.28-5.4E.el4_6.1 | 0:2.0.28-5.4E.el4_6.1 |
gd-develRed Hat:enterprise_linux:4::ws |
before 0:2.0.28-5.4E.el4_6.1 | 0:2.0.28-5.4E.el4_6.1 |
gd-progsRed Hat:enterprise_linux:4::ws |
before 0:2.0.28-5.4E.el4_6.1 | 0:2.0.28-5.4E.el4_6.1 |
gdRed Hat:enterprise_linux:5::client_workstation |
before 0:2.0.33-9.4.el5_1.1 | 0:2.0.33-9.4.el5_1.1 |
gd-debuginfoRed Hat:enterprise_linux:5::client_workstation |
before 0:2.0.33-9.4.el5_1.1 | 0:2.0.33-9.4.el5_1.1 |
gd-develRed Hat:enterprise_linux:5::client_workstation |
before 0:2.0.33-9.4.el5_1.1 | 0:2.0.33-9.4.el5_1.1 |
gdRed Hat:enterprise_linux:5::client |
before 0:2.0.33-9.4.el5_1.1 | 0:2.0.33-9.4.el5_1.1 |
gd-debuginfoRed Hat:enterprise_linux:5::client |
before 0:2.0.33-9.4.el5_1.1 | 0:2.0.33-9.4.el5_1.1 |
gd-progsRed Hat:enterprise_linux:5::client |
before 0:2.0.33-9.4.el5_1.1 | 0:2.0.33-9.4.el5_1.1 |
gdRed Hat:enterprise_linux:5::server |
before 0:2.0.33-9.4.el5_1.1 | 0:2.0.33-9.4.el5_1.1 |
gd-debuginfoRed Hat:enterprise_linux:5::server |
before 0:2.0.33-9.4.el5_1.1 | 0:2.0.33-9.4.el5_1.1 |
gd-develRed Hat:enterprise_linux:5::server |
before 0:2.0.33-9.4.el5_1.1 | 0:2.0.33-9.4.el5_1.1 |
gd-progsRed Hat:enterprise_linux:5::server |
before 0:2.0.33-9.4.el5_1.1 | 0:2.0.33-9.4.el5_1.1 |
libwmfRoot:Debian:12 |
before 0.2.12-5.1.root.io.6 | 0.2.12-5.1.root.io.60.2.12-5.1.aikido.7 |
rootio-libwmfRoot:Debian:12 |
before 0.2.12-5.1.root.io.6 | 0.2.12-5.1.root.io.60.2.12-5.1.aikido.7 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | affected, aliases, facts, references, title | GitHub Advisories, OSV |
| 2026-11-02 | created | CVE List, NVD |
References
osvdb.org/37741
bugs.libgd.org?do=details&task_id=87
trustix.org/errata/2007/0024
mandriva.com/security/advisories?name=MDKSA-2007:164
secunia.com/advisories/29157
debian.org/security/2008/dsa-1613
Show 61 moreShow less
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10348
libgd.org/ReleaseNote020035
issues.rpath.com/browse/RPL-1643
bugzilla.redhat.com/show_bug.cgi?id=277421
security.gentoo.org/glsa/glsa-200805-13.xml
securityfocus.com/archive/1/478796/100/0/threaded
redhat.com/archives/fedora-package-announce/2007-September/msg00311.html
vupen.com/english/advisories/2011/0022
lists.fedoraproject.org/pipermail/package-announce/2011-January/052848.html
novell.com/linux/security/advisories/2007_15_sr.html
fedoranews.org/updates/FEDORA-2007-205.shtml
nvd.nist.gov/vuln/detail/CVE-2007-3476
github.com/advisories/GHSA-3mpq-f59x-83gx
security-tracker.debian.org/tracker/CVE-2007-3476
access.redhat.com/errata/RHSA-2008:0146
security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0146.json
cve.org/CVERecord?id=CVE-2006-4484