CVE-2019-6977

gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch function in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1, has a heap-based buffer overflow. This can be exploited by an attacker who is able to trigger imagecolormatch calls with crafted image data.

gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch function in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1, has a heap-based buffer overflow. This can be exploited by an attacker who is able to trigger imagecolormatch calls with crafted image data.

GD is an open source code library for the dynamic creation of images by programmers. GD creates PNG, JPEG, GIF, WebP, XPM, BMP images, among other formats.

Security Fix(es):

• gd: Heap-based buffer overflow in gdImageColorMatch() in gd_color_match.c (CVE-2019-6977)

• gd: NULL pointer dereference in gdImageClone (CVE-2018-14553)

• gd: Double free in the gdImage*Ptr in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c (CVE-2019-6978)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.

gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch function in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1, has a heap-based buffer overflow. This can be exploited by an attacker who is able to trigger imagecolormatch calls with crafted image data.

GD is an open source code library for the dynamic creation of images by programmers. GD creates PNG, JPEG, GIF, WebP, XPM, BMP images, among other formats.

Security Fix(es):

• gd: Heap-based buffer overflow in gdImageColorMatch() in gd_color_match.c (CVE-2019-6977)

• gd: NULL pointer dereference in gdImageClone (CVE-2018-14553)

• gd: Double free in the gdImage*Ptr in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c (CVE-2019-6978)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• CVE-2018-14883: fix int overflow leading to heap overflow in exif_thumbnail_extract
• CVE-2019-6977: fix imagecolormatch out-of-bounds write on heap in GD
• CVE-2019-9022: fix memcpy with negative length via crafted DNS response
• CVE-2019-9640: fix invalid read in exif_process_SOFn
• CVE-2019-11042: fix heap buffer overflow in exif_process_user_comment
• CVE-2019-9638, CVE-2019-9639: fix uninitialized read in exif_process_IFD_in_MAKERNOTE (single upstream commit covers both)
• CVE-2019-9637: safer rename() procedure to avoid permission leak on EXDEV cross-filesystem fallback
• CVE-2019-19246: fix Oniguruma out-of-bounds read in str_lower_case_match
• CVE-2019-9024: fix xmlrpc base64 out-of-bounds read via unsigned char cast
• CVE-2018-20783: fix phar_parse_pharfile buffer over-read via stricter manifest bounds checks
• CVE-2018-19518: disable rsh/ssh logins in imap_open by default (new no_rsh/no_ssh INI entries)
• CVE-2018-19935: fix imap_mail NULL pointer dereference on empty message parameter

gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5 has a heap-based buffer overflow. This can be exploited by an attacker who is able to trigger calls to the function with crafted image data (CVE-2019-6977).

The GD Graphics Library (aka LibGD) 2.2.5 has a double free in the gdImage*Ptr() functions in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c (CVE-2019-6978).

This update for gd fixes the following issues:

Security issues fixed:

• CVE-2019-6977: Fixed a heap-based buffer overflow the GD Graphics Library used in the imagecolormatch function (bsc#1123361).
• CVE-2019-6978: Fixed a double free in the gdImage*Ptr() functions (bsc#1123522).

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the gd-2.3.3-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the perl-GD-2.76-1.1 package on the GA media of openSUSE Tumbleweed.

This update for php7 fixes the following issues:

Security issue fixed:

• CVE-2019-6977: Fixed a heap-based buffer overflow the GD Graphics Library used in the imagecolormatch function (bsc#1123354).
• CVE-2019-6978: Fixed a double free in the gdImage*Ptr() functions (bsc#1123522).
• CVE-2018-19935: Fixed a Denial of Service in php_imap.c which could be triggered via an empty string in the message argument to imap_mail (bsc#1118832).

This update for php5 fixes the following issues:

Security vulnerability fixed:

• CVE-2019-6977: Fixed a heap buffer overflow in gdImageColorMatch in gd_color_match.c (bsc#1123354)

This update for gd fixes the following issues:

Security issues fixed:

• CVE-2019-6977: Fixed a heap-based buffer overflow the GD Graphics Library used in the imagecolormatch function (bsc#1123361).
• CVE-2019-6978: Fixed a double free in the gdImage*Ptr() functions (bsc#1123522).

This update for gd fixes the following issues:

Security issues fixed:

• CVE-2019-6977: Fixed a heap-based buffer overflow the GD Graphics Library used in the imagecolormatch function (bsc#1123361).
• CVE-2019-6978: Fixed a double free in the gdImage*Ptr() functions (bsc#1123522).

This update for php53 fixes the following issues:

Security issues fixed:

• CVE-2019-6977: Fixed a heap-based buffer overflow the GD Graphics Library used in the imagecolormatch function (bsc#1123354).
• CVE-2019-6978: Fixed a double free in the gdImage*Ptr() functions (bsc#1123522).

It was discovered that GD incorrectly handled memory when processing certain images. A remote attacker could use this issue with a specially crafted image file to cause GD to crash, resulting in a denial of service, or possibly execute arbitrary code.