CVE-2021-40145

gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has a double free. NOTE: the vendor's position is "The GD2 image format is a proprietary image format of libgd. It has to be regarded as being obsolete, and should only be used for development and testing purposes.

gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has a double free. NOTE: the vendor's position is "The GD2 image format is a proprietary image format of libgd. It has to be regarded as being obsolete, and should only be used for development and testing purposes.

The gd graphics library allows your code to quickly draw images complete with lines, arcs, text, multiple colors, cut and paste from other images, and flood fills, and to write out the result as a PNG or JPEG file. The most common applications of GD involve website development, although it can be used with any standalone application!

Security Fix(es):

** DISPUTED ** gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has a double free. NOTE: the vendor's position is "The GD2 image format is a proprietary image format of libgd. It has to be regarded as being obsolete, and should only be used for development and testing purposes."(CVE-2021-40145)

gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has a double free. NOTE: the vendor's position is "The GD2 image format is a proprietary image format of libgd. It has to be regarded as being obsolete, and should only be used for development and testing purposes.

• CVE-2021-40145: check for memory allocation errors processing GD2 images
• CVE-2017-6363: make sure transparent index is within bounds of the palette

• CVE-2021-40145: check for memory allocation errors processing GD2 images
• CVE-2017-6363: make sure transparent index is within bounds of the palette

• SECURITY UPDATE: unhandled memory allocation error in gdImageGd2Ptr
  • debian/patches/CVE-2021-40145.patch: check for non-zero return code from _gdImageGd2
  • CVE-2021-40145
• SECURITY UPDATE: unhandled value returned from gdPutBuf
  • debian/patches/CVE-2021-40812.patch: handle possible gdPutBuf error in _gdImageBmpCtx and _gdImageWebpCtx CVE-2021-40812
• SECURITY UPDATE: unhandled value returned from gdGetBuf
  • debian/patches/CVE-2021-38115.patch: handle possible gdGetBuf error in read_header_tga CVE-2021-38115
• SECURITY UPDATE: handle possible heap buffer overread
  • debian/patches/CVE-2017-6363.patch: make sure transparent index is within bounds of the palette CVE-2017-6363

• CVE-2021-40145: Fix a double free

• CVE-2021-40145: Fix a double free in gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library

• Fix CVE-2021-40145: double-free in gdImageGd2Ptr()

• CVE-2021-40145: Fix a double free in gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library

• CVE-2021-40145: fix double free in gdImageGd2Ptr

• CVE-2021-40145: fix double free in gdImageGd2Ptr

read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file. (CVE-2021-38115)

gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has a double free. (CVE-2021-40145)

It was discovered that GD Graphics Library incorrectly handled certain GD and GD2 files. An attacker could possibly use this issue to cause a crash or expose sensitive information. This issue only affected Ubuntu 20.04 LTS, Ubuntu 18.04 LTS, Ubuntu 16.04 ESM, and Ubuntu 14.04 ESM. (CVE-2017-6363)

It was discovered that GD Graphics Library incorrectly handled certain TGA files. An attacker could possibly use this issue to cause a denial of service or expose sensitive information. (CVE-2021-381)

It was discovered that GD Graphics Library incorrectly handled certain files. An attacker could possibly use this issue to cause a crash. (CVE-2021-40145)