Every CVE Search/ Get API key

CVE-2017-6363

** DISPUTED ** In the GD Graphics Library (aka LibGD) through 2.2.5, there is a heap-based buffer...

8.1 HighFix availableDisputed

In the GD Graphics Library (aka LibGD) through 2.2.5, there is a heap-based buffer over-read in tiffWriter in gd_tiff.c. NOTE: the vendor says "In my opinion this issue should not have a CVE, since the GD and GD2 formats are documented to be 'obsolete, and should only be used for development and testing purposes.'

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
High

Exploit likelihood

1.40%Up 1.0 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 8.1

In the GD Graphics Library (aka LibGD) through 2.2.5, there is a heap-based buffer over-read in tiffWriter in gd_tiff.c. NOTE: the vendor says "In my opinion this issue should not have a CVE, since the GD and GD2 formats are documented to be 'obsolete, and should only be used for development and testing purposes.'

Record
CVE-2017-6363
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
CVSS 2.0
5.8 MediumAV:N/AC:M/Au:N/C:P/I:N/A:P
Weakness
CWE-125
Updated
2026-11-02
CVE List No score

In the GD Graphics Library (aka LibGD) through 2.2.5, there is a heap-based buffer over-read in tiffWriter in gd_tiff.c. NOTE: the vendor says "In my opinion this issue should not have a CVE, since the GD and GD2 formats are documented to be 'obsolete, and should only be used for development and testing purposes.'

Record
CVE-2017-6363
Updated
2026-11-02
EUVDEUVD-2017-15424 No score

In the GD Graphics Library (aka LibGD) through 2.2.5, there is a heap-based buffer over-read in tiffWriter in gd_tiff.c. NOTE: the vendor says "In my opinion this issue should not have a CVE, since the GD and GD2 formats are documented to be 'obsolete, and should only be used for development and testing purposes.'

Record
EUVD-2017-15424
Updated
2026-11-03
GitHub AdvisoriesGHSA-pfv9-ff57-j64p 8.1

** DISPUTED ** In the GD Graphics Library (aka LibGD) through 2.2.5, there is a heap-based buffer...

** DISPUTED ** In the GD Graphics Library (aka LibGD) through 2.2.5, there is a heap-based buffer over-read in tiffWriter in gd_tiff.c. NOTE: the vendor says "In my opinion this issue should not have a CVE, since the GD and GD2 formats are documented to be 'obsolete, and should only be used for development and testing purposes.'"

Record
GHSA-pfv9-ff57-j64p
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
OSVALPINE-CVE-2017-6363 8.1

In the GD Graphics Library (aka LibGD) through 2.2.5, there is a heap-based buffer over-read in tiffWriter in gd_tiff.c. NOTE: the vendor says "In my opinion this issue should not have a CVE, since the GD and GD2 formats are documented to be 'obsolete, and should only be used for development and testing purposes.'

Record
ALPINE-CVE-2017-6363
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVBELL-CVE-2017-6363 8.1

CVE-2017-6363 does not affect BellSoft software

Record
BELL-CVE-2017-6363
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Updated
2026-11-02
Show 7 moreShow less
OSV 8.1

In the GD Graphics Library (aka LibGD) through 2.2.5, there is a heap-based buffer over-read in tiffWriter in gd_tiff.c. NOTE: the vendor says "In my opinion this issue should not have a CVE, since the GD and GD2 formats are documented to be 'obsolete, and should only be used for development and testing purposes.'

Record
CVE-2017-6363
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2017-6363 8.1

In the GD Graphics Library (aka LibGD) through 2.2.5, there is a heap-based buffer over-read in tiffWriter in gd_tiff.c. NOTE: the vendor says "In my opinion this issue should not have a CVE, since the GD and GD2 formats are documented to be 'obsolete, and should only be used for development and testing purposes.'

Record
DEBIAN-CVE-2017-6363
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2017-6363 8.1

In the GD Graphics Library (aka LibGD) through 2.2.5, there is a heap-based buffer over-read in tiffWriter in gd_tiff.c. NOTE: the vendor says "In my opinion this issue should not have a CVE, since the GD and GD2 formats are documented to be 'obsolete, and should only be used for development and testing purposes.'

Record
UBUNTU-CVE-2017-6363
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVCLSA-2021-1634919016 No score

Fixed CVEs in gd: CVE-2017-6363, CVE-2021-40145

  • CVE-2021-40145: check for memory allocation errors processing GD2 images
  • CVE-2017-6363: make sure transparent index is within bounds of the palette
Record
CLSA-2021-1634919016
Updated
2026-11-02
OSVCLSA-2021-1635439636 No score

Fix of CVE: CVE-2017-6363, CVE-2021-40145

  • CVE-2021-40145: check for memory allocation errors processing GD2 images
  • CVE-2017-6363: make sure transparent index is within bounds of the palette
Record
CLSA-2021-1635439636
Updated
2026-11-02
OSVCLSA-2021-1635459219 No score

Fix CVE(s): CVE-2021-40812, CVE-2021-40145, CVE-2021-38115, CVE-2017-6363

  • SECURITY UPDATE: unhandled memory allocation error in gdImageGd2Ptr
    • debian/patches/CVE-2021-40145.patch: check for non-zero return code from _gdImageGd2
    • CVE-2021-40145
  • SECURITY UPDATE: unhandled value returned from gdPutBuf
    • debian/patches/CVE-2021-40812.patch: handle possible gdPutBuf error in _gdImageBmpCtx and _gdImageWebpCtx CVE-2021-40812
  • SECURITY UPDATE: unhandled value returned from gdGetBuf
    • debian/patches/CVE-2021-38115.patch: handle possible gdGetBuf error in read_header_tga CVE-2021-38115
  • SECURITY UPDATE: handle possible heap buffer overread
    • debian/patches/CVE-2017-6363.patch: make sure transparent index is within bounds of the palette CVE-2017-6363
Record
CLSA-2021-1635459219
Updated
2026-11-02
OSVUSN-5068-1 No score

libgd2 vulnerabilities

It was discovered that GD Graphics Library incorrectly handled certain GD and GD2 files. An attacker could possibly use this issue to cause a crash or expose sensitive information. This issue only affected Ubuntu 20.04 LTS, Ubuntu 18.04 LTS, Ubuntu 16.04 ESM, and Ubuntu 14.04 ESM. (CVE-2017-6363)

It was discovered that GD Graphics Library incorrectly handled certain TGA files. An attacker could possibly use this issue to cause a denial of service or expose sensitive information. (CVE-2021-381)

It was discovered that GD Graphics Library incorrectly handled certain files. An attacker could possibly use this issue to cause a crash. (CVE-2021-40145)

Record
USN-5068-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
gd
Alpine:v3.11
 before 2.2.5-r4
2.2.5-r4
gd
Alpine:v3.12
 before 2.3.0-r0
2.3.0-r0
gd
Alpine:v3.13
 before 2.3.0-r0
2.3.0-r0
gd
Alpine:v3.14
 before 2.3.0-r0
2.3.0-r0
gd
Alpine:v3.15
 before 2.3.0-r0
2.3.0-r0
gd
Alpine:v3.16
 before 2.3.0-r0
2.3.0-r0
gd
Alpine:v3.17
 before 2.3.0-r0
2.3.0-r0
gd
Alpine:v3.18
 before 2.3.0-r0
2.3.0-r0
gd
Alpine:v3.19
 before 2.3.0-r0
2.3.0-r0
gd
Alpine:v3.20
 before 2.3.0-r0
2.3.0-r0
Show 20 moreShow less
Affected packages
PackageAffectedFixed
gd
Alpine:v3.21
 before 2.3.0-r0
2.3.0-r0
gd
Alpine:v3.22
 before 2.3.0-r0
2.3.0-r0
gd
Alpine:v3.23
 before 2.3.0-r0
2.3.0-r0
gd
Alpine:v3.24
 before 2.3.0-r0
2.3.0-r0
gd
TuxCare:OracleLinux:6
 before 2.0.35-12.el6.cloudlinux.els
2.0.35-12.el6.cloudlinux.els
gd-devel
TuxCare:OracleLinux:6
 before 2.0.35-12.el6.cloudlinux.els
2.0.35-12.el6.cloudlinux.els
gd-progs
TuxCare:OracleLinux:6
 before 2.0.35-12.el6.cloudlinux.els
2.0.35-12.el6.cloudlinux.els
gd
TuxCare:CentOS:6
 before 2.0.35-12.el6.cloudlinux.els
2.0.35-12.el6.cloudlinux.els
gd-devel
TuxCare:CentOS:6
 before 2.0.35-12.el6.cloudlinux.els
2.0.35-12.el6.cloudlinux.els
gd-progs
TuxCare:CentOS:6
 before 2.0.35-12.el6.cloudlinux.els
2.0.35-12.el6.cloudlinux.els
libgd-dev
TuxCare:Ubuntu:16.04
 before 2.1.1-4ubuntu0.16.04.13
2.1.1-4ubuntu0.16.04.13
libgd-tools
TuxCare:Ubuntu:16.04
 before 2.1.1-4ubuntu0.16.04.13
2.1.1-4ubuntu0.16.04.13
libgd3
TuxCare:Ubuntu:16.04
 before 2.1.1-4ubuntu0.16.04.13
2.1.1-4ubuntu0.16.04.13
libgd2
Debian:12
 before 2.3.0-1
2.3.0-1
libgd2
Debian:13
 before 2.3.0-1
2.3.0-1
libgd2
Debian:14
 before 2.3.0-1
2.3.0-1
libgd2
Ubuntu:Pro:14.04:LTS
 before 2.1.0-3ubuntu0.11+esm2, plus listed versions
2.1.0-22.1.0-32.1.0-3ubuntu0.12.1.0-3ubuntu0.22.1.0-3ubuntu0.3
Show 7 moreShow less
2.1.0-3ubuntu0.52.1.0-3ubuntu0.62.1.0-3ubuntu0.72.1.0-3ubuntu0.82.1.0-3ubuntu0.102.1.0-3ubuntu0.112.1.0-3ubuntu0.11+esm1
2.1.0-3ubuntu0.11+esm2
libgd2
Ubuntu:Pro:16.04:LTS
 before 2.1.1-4ubuntu0.16.04.12+esm1, plus listed versions
2.1.1-4build12.1.1-4build22.1.1-4ubuntu0.16.04.12.1.1-4ubuntu0.16.04.22.1.1-4ubuntu0.16.04.3
Show 7 moreShow less
2.1.1-4ubuntu0.16.04.52.1.1-4ubuntu0.16.04.62.1.1-4ubuntu0.16.04.72.1.1-4ubuntu0.16.04.82.1.1-4ubuntu0.16.04.102.1.1-4ubuntu0.16.04.112.1.1-4ubuntu0.16.04.12
2.1.1-4ubuntu0.16.04.12+esm1
libgd2
Ubuntu:18.04:LTS
 before 2.2.5-4ubuntu0.5, plus listed versions
2.2.5-32.2.5-42.2.5-4ubuntu0.22.2.5-4ubuntu0.32.2.5-4ubuntu0.4
2.2.5-4ubuntu0.5
libgd2
Ubuntu:20.04:LTS
 before 2.2.5-5.2ubuntu2.1, plus listed versions
2.2.5-5.22.2.5-5.2ubuntu2
2.2.5-5.2ubuntu2.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-6363 is a high vulnerability (CVSS 8.1) in Libgd, published February 27, 2020. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 1.40%, the 72nd percentile. Fixed in gd 2.2.5-r4.

References

Show 10 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open