CVE-2004-0990
Integer overflow in GD Graphics Library libgd 2.0.28 (libgd2), and possibly other versions,...
Integer overflow in GD Graphics Library libgd 2.0.28 (libgd2), and possibly other versions, allows remote attackers to cause a denial of service and possibly execute arbitrary code via PNG image files with large image rows values that lead to a heap-based buffer overflow in the gdImageCreateFromPngCtx function, a different set of vulnerabilities than CVE-2004-0941.
Exploit likelihood
What each source reports
NVD Score used
Integer overflow in GD Graphics Library libgd 2.0.28 (libgd2), and possibly other versions, allows remote attackers to cause a denial of service and possibly execute arbitrary code via PNG image files with large image rows values that lead to a heap-based buffer overflow in the gdImageCreateFromPngCtx function, a different set of vulnerabilities than CVE-2004-0941.
- Record
CVE-2004-0990- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
Integer overflow in GD Graphics Library libgd 2.0.28 (libgd2), and possibly other versions, allows remote attackers to cause a denial of service and possibly execute arbitrary code via PNG image files with large image rows values that lead to a heap-based buffer overflow in the gdImageCreateFromPngCtx function, a different set of vulnerabilities than CVE-2004-0941.
- Record
CVE-2004-0990- Updated
- 2026-11-02
EUVDEUVD-2004-0988 No score
Integer overflow in GD Graphics Library libgd 2.0.28 (libgd2), and possibly other versions, allows remote attackers to cause a denial of service and possibly execute arbitrary code via PNG image files with large image rows values that lead to a heap-based buffer overflow in the gdImageCreateFromPngCtx function, a different set of vulnerabilities than CVE-2004-0941.
- Record
EUVD-2004-0988- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-23x9-mmjc-x474 No score
Integer overflow in GD Graphics Library libgd 2.0.28 (libgd2), and possibly other versions,...
Integer overflow in GD Graphics Library libgd 2.0.28 (libgd2), and possibly other versions, allows remote attackers to cause a denial of service and possibly execute arbitrary code via PNG image files with large image rows values that lead to a heap-based buffer overflow in the gdImageCreateFromPngCtx function, a different set of vulnerabilities than CVE-2004-0941.
- Record
GHSA-23x9-mmjc-x474- Updated
- 2026-11-02
OSV No score
Integer overflow in GD Graphics Library libgd 2.0.28 (libgd2), and possibly other versions, allows remote attackers to cause a denial of service and possibly execute arbitrary code via PNG image files with large image rows values that lead to a heap-based buffer overflow in the gdImageCreateFromPngCtx function, a different set of vulnerabilities than CVE-2004-0941.
- Record
CVE-2004-0990- Updated
- 2026-11-02
OSVDEBIAN-CVE-2004-0990 No score
Integer overflow in GD Graphics Library libgd 2.0.28 (libgd2), and possibly other versions, allows remote attackers to cause a denial of service and possibly execute arbitrary code via PNG image files with large image rows values that lead to a heap-based buffer overflow in the gdImageCreateFromPngCtx function, a different set of vulnerabilities than CVE-2004-0941.
- Record
DEBIAN-CVE-2004-0990- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libgd2Debian:12 |
before 2.0.30-1 | 2.0.30-1 |
libgd2Debian:13 |
before 2.0.30-1 | 2.0.30-1 |
libgd2Debian:14 |
before 2.0.30-1 | 2.0.30-1 |
libgdDebian:3.0 |
before 1.8.4-17.woody3, plus listed versions 1.8.4-17.woody2 |
1.8.4-17.woody3 |
libgd2Debian:3.0 |
before 2.0.1-10woody1 | 2.0.1-10woody1 |
libgdDebian:3.0 From an advisory covering 2 CVEs |
before 1.8.4-17.woody4, plus listed versions 1.8.4-17.woody2 |
1.8.4-17.woody4 |
libgd2Debian:3.0 From an advisory covering 2 CVEs |
before 2.0.1-10woody2 | 2.0.1-10woody2 |
gdRed Hat:enterprise_linux:3::as From an advisory covering 2 CVEs |
before 0:1.8.4-12.3.1 | 0:1.8.4-12.3.1 |
gd-debuginfoRed Hat:enterprise_linux:3::as From an advisory covering 2 CVEs |
before 0:1.8.4-12.3.1 | 0:1.8.4-12.3.1 |
gd-develRed Hat:enterprise_linux:3::as From an advisory covering 2 CVEs |
before 0:1.8.4-12.3.1 | 0:1.8.4-12.3.1 |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
gd-progsRed Hat:enterprise_linux:3::as From an advisory covering 2 CVEs |
before 0:1.8.4-12.3.1 | 0:1.8.4-12.3.1 |
gdRed Hat:enterprise_linux:3::desktop From an advisory covering 2 CVEs |
before 0:1.8.4-12.3.1 | 0:1.8.4-12.3.1 |
gd-debuginfoRed Hat:enterprise_linux:3::desktop From an advisory covering 2 CVEs |
before 0:1.8.4-12.3.1 | 0:1.8.4-12.3.1 |
gd-develRed Hat:enterprise_linux:3::desktop From an advisory covering 2 CVEs |
before 0:1.8.4-12.3.1 | 0:1.8.4-12.3.1 |
gd-progsRed Hat:enterprise_linux:3::desktop From an advisory covering 2 CVEs |
before 0:1.8.4-12.3.1 | 0:1.8.4-12.3.1 |
gdRed Hat:enterprise_linux:3::es From an advisory covering 2 CVEs |
before 0:1.8.4-12.3.1 | 0:1.8.4-12.3.1 |
gd-debuginfoRed Hat:enterprise_linux:3::es From an advisory covering 2 CVEs |
before 0:1.8.4-12.3.1 | 0:1.8.4-12.3.1 |
gd-develRed Hat:enterprise_linux:3::es From an advisory covering 2 CVEs |
before 0:1.8.4-12.3.1 | 0:1.8.4-12.3.1 |
gd-progsRed Hat:enterprise_linux:3::es From an advisory covering 2 CVEs |
before 0:1.8.4-12.3.1 | 0:1.8.4-12.3.1 |
gdRed Hat:enterprise_linux:3::ws From an advisory covering 2 CVEs |
before 0:1.8.4-12.3.1 | 0:1.8.4-12.3.1 |
gd-debuginfoRed Hat:enterprise_linux:3::ws From an advisory covering 2 CVEs |
before 0:1.8.4-12.3.1 | 0:1.8.4-12.3.1 |
gd-develRed Hat:enterprise_linux:3::ws From an advisory covering 2 CVEs |
before 0:1.8.4-12.3.1 | 0:1.8.4-12.3.1 |
gd-progsRed Hat:enterprise_linux:3::ws From an advisory covering 2 CVEs |
before 0:1.8.4-12.3.1 | 0:1.8.4-12.3.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | GD Graphics Library - Local Heap Overflow | 2004-10-26 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2004-0990 is a high vulnerability (CVSS 10.0) in Gd Graphics Library Gdlib, published October 28, 2004. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 28.3%, the 98th percentile. Fixed in libgd2 2.0.30-1.
References
ciac.org/ciac/bulletins/p-071.shtml
secunia.com/advisories/23783
osvdb.org/11190
securityfocus.com/bid/11523
exchange.xforce.ibmcloud.com/vulnerabilities/17866
Show 35 moreShow less
redhat.com/support/errata/RHSA-2004-638.html
debian.org/security/2004/dsa-602
mandriva.com/security/advisories?name=MDKSA-2006:113
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1260
lists.suse.com/archive/suse-security-announce/2006-Feb/0001.html
trustix.org/errata/2004/0058
issues.rpath.com/browse/RPL-939
ubuntu.com/usn/usn-25-1
marc.info?l=bugtraq&m=109882489302099&w=2
nvd.nist.gov/vuln/detail/CVE-2004-0990
github.com/advisories/GHSA-23x9-mmjc-x474
security-tracker.debian.org/tracker/CVE-2004-0990
access.redhat.com/errata/RHSA-2004:638
bugzilla.redhat.com/show_bug.cgi?id=137246
security.access.redhat.com/data/csaf/v2/advisories/2004/rhsa-2004_638.json
cve.org/CVERecord?id=CVE-2004-0941