{"id":"CVE-2019-6978","aliases":["ALPINE-CVE-2019-6978","ALSA-2019:2722","ALSA-2020:4659","BELL-CVE-2019-6978","DEBIAN-CVE-2019-6978","DLA-1651-1","DSA-4384-1","EUVD-2019-16530","GHSA-7v6r-3q36-qvvp","MGASA-2019-0073","MGASA-2019-0085","RHSA-2019:2722","RHSA-2020:3943","RHSA-2020:4659","RLSA-2019:2722","RLSA-2020:4659","SUSE-SU-2019:0333-1","SUSE-SU-2019:0747-1","SUSE-SU-2019:0771-1","SUSE-SU-2019:13961-1","SUSE-SU-2022:1516-1","SUSE-SU-2022:1560-1","UBUNTU-CVE-2019-6978","USN-3900-1","openSUSE-SU-2019:1148-1","openSUSE-SU-2024:10777-1","openSUSE-SU-2024:11012-1"],"status":"published","title":"The GD Graphics Library (aka LibGD) 2.2.5 has a double free in the gdImage*Ptr() functions in...","description":"The GD Graphics Library (aka LibGD) 2.2.5 has a double free in the gdImage*Ptr() functions in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c. NOTE: PHP is unaffected.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.04452,"percentile":0.9149,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-415"],"published":"2019-01-28T00:00:00Z","modified":"2026-10-29T11:00:14Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"gd","fixed_in":["2.2.5-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"gd","fixed_in":["2.2.5-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"gd","fixed_in":["2.2.5-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"gd","fixed_in":["2.2.5-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"gd","fixed_in":["2.2.5-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"gd","fixed_in":["2.2.5-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"gd","fixed_in":["2.2.5-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"gd","fixed_in":["2.2.5-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"gd","fixed_in":["2.2.5-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"gd","fixed_in":["2.2.5-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"gd","fixed_in":["2.2.5-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"gd","fixed_in":["2.2.5-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"gd","fixed_in":["2.2.5-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"gd","fixed_in":["2.2.5-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"gd","fixed_in":["2.2.5-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"gd","fixed_in":["2.2.5-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"gd","fixed_in":["2.2.5-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"gd","fixed_in":["2.2.5-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"gd","fixed_in":["2.2.5-r2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"libwmf","fixed_in":["0.2.9-8.el8_0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"libwmf-devel","fixed_in":["0.2.9-8.el8_0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"libwmf-lite","fixed_in":["0.2.9-8.el8_0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libgd2","fixed_in":["2.2.5-5.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libgd2","fixed_in":["2.2.5-5.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libgd2","fixed_in":["2.2.5-5.1"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"libwmf","fixed_in":["0.2.12-1.mga6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwmf","fixed_in":["0:0.2.9-8.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwmf-debuginfo","fixed_in":["0:0.2.9-8.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwmf-debugsource","fixed_in":["0:0.2.9-8.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwmf-lite","fixed_in":["0:0.2.9-8.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwmf-lite-debuginfo","fixed_in":["0:0.2.9-8.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libwmf-debuginfo","fixed_in":["0:0.2.9-8.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libwmf-debugsource","fixed_in":["0:0.2.9-8.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libwmf-devel","fixed_in":["0:0.2.9-8.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libwmf-lite-debuginfo","fixed_in":["0:0.2.9-8.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"libwmf","fixed_in":["0:0.2.8.4-44.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"libwmf-debuginfo","fixed_in":["0:0.2.8.4-44.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"libwmf-lite","fixed_in":["0:0.2.8.4-44.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"libwmf-devel","fixed_in":["0:0.2.8.4-44.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libwmf","fixed_in":["0:0.2.8.4-44.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libwmf-debuginfo","fixed_in":["0:0.2.8.4-44.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libwmf-devel","fixed_in":["0:0.2.8.4-44.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libwmf-lite","fixed_in":["0:0.2.8.4-44.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"libwmf","fixed_in":["0:0.2.8.4-44.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"libwmf-debuginfo","fixed_in":["0:0.2.8.4-44.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"libwmf-lite","fixed_in":["0:0.2.8.4-44.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"libwmf-devel","fixed_in":["0:0.2.8.4-44.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libwmf","fixed_in":["0:0.2.8.4-44.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libwmf-debuginfo","fixed_in":["0:0.2.8.4-44.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libwmf-lite","fixed_in":["0:0.2.8.4-44.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libwmf-devel","fixed_in":["0:0.2.8.4-44.el7"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"libwmf","fixed_in":["0:0.2.9-8.el8_0"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"libgd2","fixed_in":["2.1.0-3ubuntu0.11"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"libgd2","fixed_in":["2.1.1-4ubuntu0.16.04.11"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libgd2","fixed_in":["2.2.5-4ubuntu0.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-r2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libwmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.9-8.el8_0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libwmf-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.9-8.el8_0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libwmf-lite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.9-8.el8_0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-7.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"gd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-7.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"libgd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-5.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libgd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-5.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libgd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-5.1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"libgd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-5+deb8u12"}]}],"versions":["2.1.0-5","2.1.0-5+deb8u1","2.1.0-5+deb8u10","2.1.0-5+deb8u11","2.1.0-5+deb8u2","2.1.0-5+deb8u3","2.1.0-5+deb8u4","2.1.0-5+deb8u5","2.1.0-5+deb8u6","2.1.0-5+deb8u7","2.1.0-5+deb8u8","2.1.0-5+deb8u9"],"bundled":4},{"source":"osv","ecosystem":"Debian:9","package":"libgd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.4-2+deb9u4"}]}],"versions":["2.2.4-2","2.2.4-2+deb9u1","2.2.4-2+deb9u2","2.2.4-2+deb9u3"],"bundled":2},{"source":"osv","ecosystem":"Mageia:6","package":"libgd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-2.3.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:6","package":"libwmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.12-1.mga6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.9-8.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwmf-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.9-8.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwmf-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.9-8.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwmf-lite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.9-8.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwmf-lite-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.9-8.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libwmf-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.9-8.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libwmf-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.9-8.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libwmf-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.9-8.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libwmf-lite-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.9-8.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libwmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.8.4-44.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libwmf-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.8.4-44.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libwmf-lite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.8.4-44.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libwmf-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.8.4-44.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libwmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.8.4-44.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libwmf-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.8.4-44.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libwmf-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.8.4-44.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libwmf-lite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.8.4-44.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libwmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.8.4-44.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libwmf-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.8.4-44.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libwmf-lite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.8.4-44.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libwmf-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.8.4-44.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libwmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.8.4-44.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libwmf-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.8.4-44.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libwmf-lite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.8.4-44.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libwmf-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.8.4-44.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-7.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-7.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-7.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-7.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gd-progs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-7.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libwmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.9-8.el8_0"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-7.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-50.63.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-50.63.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-50.63.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-24.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-24.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-24.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-24.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-24.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-24.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-24.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-24.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-24.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP4","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-24.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-4.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-4.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"php53","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.17-112.53.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"php53","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.17-112.53.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"php53","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.17-112.53.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"libwmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.12-150000.4.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP3","package":"libwmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.12-150000.4.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"libwmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.12-150000.4.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"libwmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.12-150000.4.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libwmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.12-243.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"libwmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.12-243.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libgd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-3ubuntu0.11"}]}],"versions":["2.1.0-2","2.1.0-3","2.1.0-3ubuntu0.1","2.1.0-3ubuntu0.2","2.1.0-3ubuntu0.3","2.1.0-3ubuntu0.5","2.1.0-3ubuntu0.6","2.1.0-3ubuntu0.7","2.1.0-3ubuntu0.8","2.1.0-3ubuntu0.10"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libgd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-4ubuntu0.16.04.11"}]}],"versions":["2.1.1-4build1","2.1.1-4build2","2.1.1-4ubuntu0.16.04.1","2.1.1-4ubuntu0.16.04.2","2.1.1-4ubuntu0.16.04.3","2.1.1-4ubuntu0.16.04.5","2.1.1-4ubuntu0.16.04.6","2.1.1-4ubuntu0.16.04.7","2.1.1-4ubuntu0.16.04.8","2.1.1-4ubuntu0.16.04.10"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libgd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-4ubuntu0.3"}]}],"versions":["2.2.5-3","2.2.5-4","2.2.5-4ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libgd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-3ubuntu0.11"}]}],"versions":["2.1.0-2","2.1.0-3","2.1.0-3ubuntu0.1","2.1.0-3ubuntu0.2","2.1.0-3ubuntu0.3","2.1.0-3ubuntu0.5","2.1.0-3ubuntu0.6","2.1.0-3ubuntu0.7","2.1.0-3ubuntu0.8","2.1.0-3ubuntu0.10"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libgd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-4ubuntu0.16.04.11"}]}],"versions":["2.1.1-4build1","2.1.1-4build2","2.1.1-4ubuntu0.16.04.1","2.1.1-4ubuntu0.16.04.2","2.1.1-4ubuntu0.16.04.3","2.1.1-4ubuntu0.16.04.5","2.1.1-4ubuntu0.16.04.6","2.1.1-4ubuntu0.16.04.7","2.1.1-4ubuntu0.16.04.8","2.1.1-4ubuntu0.16.04.10"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libgd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-4ubuntu0.3"}]}],"versions":["2.2.5-3","2.2.5-4","2.2.5-4ubuntu0.2"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-lp150.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-1.1"}]}],"bundled":14}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"libgd","product":"libgd"}],"references":[{"url":"https://github.com/php/php-src/commit/089f7c0bc28d399b0420aa6ef058e4c1c120b2ae","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://usn.ubuntu.com/3900-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/01/msg00028.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://github.com/libgd/libgd/issues/492","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://www.debian.org/security/2019/dsa-4384","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/libgd/libgd/commit/553702980ae89c83f2d6e254d62cf82e204956d0","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://security.gentoo.org/glsa/201903-18","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00025.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00031.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2722","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TEYUUOW75YD3DENIPYMO263E6NL2NFHI/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3WRUPZVT2MWFUEMVGTRAGDOBHLNMGK5R/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TTXSLRZI5BCQT3H5KALG3DHUWUMNPDX2/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3CZ2QADQTKRHTGB2AHD7J4QQNDLBEMM6/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-6978","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3CZ2QADQTKRHTGB2AHD7J4QQNDLBEMM6/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3WRUPZVT2MWFUEMVGTRAGDOBHLNMGK5R/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TEYUUOW75YD3DENIPYMO263E6NL2NFHI/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TTXSLRZI5BCQT3H5KALG3DHUWUMNPDX2/"},{"url":"https://github.com/advisories/GHSA-7v6r-3q36-qvvp"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-6978","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2019-2722.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2019-6978","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2020-4659.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2018-14553","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-6977","tags":["report"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-6978","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-6978","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0073.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24336","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2019-0085.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24344","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/L32G56HKBVCM2HEZASWDWDWEXQTBWNZP/","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1671390","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2722.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-6978","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-6978","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3943","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.9_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1840569","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3943.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:4659","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1600727","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1672207","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4659.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-14553","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-14553","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-14553","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-6977","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-6977","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-6977","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2019:2722","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2020:4659","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190333-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1118832","tags":["report"]},{"url":"https://bugzilla.suse.com/1123354","tags":["report"]},{"url":"https://bugzilla.suse.com/1123522","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6977","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6978","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190747-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1123361","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190771-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-201913961-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221516-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1006739","tags":["report"]},{"url":"https://bugzilla.suse.com/1174075","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9011","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221560-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-6978","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3900-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-6977","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BTHBKC7A4BRQZVCDIQQU2NJC4NYEFV5X/#BTHBKC7A4BRQZVCDIQQU2NJC4NYEFV5X","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2007-2756","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5711","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-3376","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-6978","description":"The GD Graphics Library (aka LibGD) 2.2.5 has a double free in the gdImage*Ptr() functions in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c. NOTE: PHP is unaffected.","status":"published","published":"2019-01-28T07:00:00Z","modified":"2024-08-04T20:38:32.579Z","updated_at":"2026-11-02T14:20:23.381621Z"}],"euvd":[{"id":"EUVD-2019-16530","description":"The GD Graphics Library (aka LibGD) 2.2.5 has a double free in the gdImage*Ptr() functions in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c. NOTE: PHP is unaffected.","status":"published","published":"2019-01-28T07:00:00Z","modified":"2024-08-04T20:38:32Z","updated_at":"2026-11-03T03:06:47.494697Z"}],"ghsa":[{"id":"GHSA-7v6r-3q36-qvvp","title":"The GD Graphics Library (aka LibGD) 2.2.5 has a double free in the gdImage*Ptr() functions in...","description":"The GD Graphics Library (aka LibGD) 2.2.5 has a double free in the gdImage*Ptr() functions in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c. NOTE: PHP is unaffected.","status":"published","published":"2022-05-14T01:12:47Z","modified":"2023-02-02T05:03:17Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T14:51:36.626177Z"}],"nvd":[{"id":"CVE-2019-6978","description":"The GD Graphics Library (aka LibGD) 2.2.5 has a double free in the gdImage*Ptr() functions in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c. NOTE: PHP is unaffected.","status":"published","published":"2019-01-28T08:29:00.607Z","modified":"2026-06-17T02:39:51.863Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T14:05:02.989216Z"}],"osv":[{"id":"ALPINE-CVE-2019-6978","description":"The GD Graphics Library (aka LibGD) 2.2.5 has a double free in the gdImage*Ptr() functions in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c. NOTE: PHP is unaffected.","status":"published","published":"2019-01-28T08:29:00.607Z","modified":"2026-09-21T06:17:52.534088552Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:48.11886Z"},{"id":"BELL-CVE-2019-6978","title":"CVE-2019-6978 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:50.93718Z","modified":"2026-09-06T07:15:14.005516139Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-6978","description":"The GD Graphics Library (aka LibGD) 2.2.5 has a double free in the gdImage*Ptr() functions in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c. NOTE: PHP is unaffected.","status":"published","published":"2019-01-28T08:29:00.607Z","modified":"2026-10-24T14:22:34.686459222Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:12.675558Z"},{"id":"DEBIAN-CVE-2019-6978","description":"The GD Graphics Library (aka LibGD) 2.2.5 has a double free in the gdImage*Ptr() functions in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c. NOTE: PHP is unaffected.","status":"published","published":"2019-01-28T08:29:00.607Z","modified":"2026-09-21T07:03:22.947224008Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:32.57265Z"},{"id":"RHSA-2019:2722","title":"Red Hat Security Advisory: libwmf security update","status":"published","published":"2024-09-16T02:50:25Z","modified":"2026-06-26T12:21:59.947568196Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"RHSA-2020:3943","title":"Red Hat Security Advisory: libwmf security and bug fix update","status":"published","published":"2024-09-16T02:50:31Z","modified":"2026-06-26T12:22:26.891253103Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RHSA-2020:4659","title":"Red Hat Security Advisory: gd security update","status":"published","published":"2024-09-16T04:05:10Z","modified":"2026-06-29T10:32:39Z","cvss":[{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RLSA-2019:2722","title":"Low: libwmf security update","description":"The libwmf packages provide a library for reading and converting Windows Metafile Format (WMF) vector graphics. The library is used by applications such as GIMP and ImageMagick.\n\nSecurity Fix(es):\n\n* gd: double free in the gdImage*Ptr in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c (CVE-2019-6978)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2019-09-10T15:32:59Z","modified":"2026-02-05T00:15:11.708183Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RLSA-2020:4659","title":"Moderate: gd security update","description":"GD is an open source code library for the dynamic creation of images by programmers. GD creates PNG, JPEG, GIF, WebP, XPM, BMP images, among other formats. \n\nSecurity Fix(es):\n\n* gd: Heap-based buffer overflow in gdImageColorMatch() in gd_color_match.c (CVE-2019-6977)\n\n* gd: NULL pointer dereference in gdImageClone (CVE-2018-14553)\n\n* gd: Double free in the gdImage*Ptr in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c (CVE-2019-6978)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.","status":"published","published":"2020-11-03T12:24:40Z","modified":"2026-02-05T14:00:10.843328Z","cvss":[{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2019-6978","description":"The GD Graphics Library (aka LibGD) 2.2.5 has a double free in the gdImage*Ptr() functions in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c. NOTE: PHP is unaffected.","status":"published","published":"2019-01-28T00:00:00Z","modified":"2026-04-22T12:21:19.281006Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:21.741399Z"},{"id":"ALSA-2019:2722","title":"Low: libwmf security update","description":"The libwmf packages provide a library for reading and converting Windows Metafile Format (WMF) vector graphics. The library is used by applications such as GIMP and ImageMagick.\n\nSecurity Fix(es):\n\n* gd: double free in the gdImage*Ptr in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c (CVE-2019-6978)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2019-09-10T15:32:59Z","modified":"2026-10-29T11:00:04.930250188Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"ALSA-2020:4659","title":"Moderate: gd security update","description":"GD is an open source code library for the dynamic creation of images by programmers. GD creates PNG, JPEG, GIF, WebP, XPM, BMP images, among other formats. \n\nSecurity Fix(es):\n\n* gd: Heap-based buffer overflow in gdImageColorMatch() in gd_color_match.c (CVE-2019-6977)\n\n* gd: NULL pointer dereference in gdImageClone (CVE-2018-14553)\n\n* gd: Double free in the gdImage*Ptr in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c (CVE-2019-6978)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2020-11-03T12:24:40Z","modified":"2026-10-29T11:00:14.499935688Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"DLA-1651-1","title":"libgd2 - security update","status":"published","published":"2019-01-30T00:00:00Z","modified":"2026-03-09T01:20:06.623659Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-4384-1","title":"libgd2 - security update","status":"published","published":"2019-02-04T00:00:00Z","modified":"2026-03-09T02:10:45.323628Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2019-0073","title":"Updated libgd packages fix security vulnerability","description":"gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka\nLibGD) 2.2.5 has a heap-based buffer overflow. This can be exploited by an\nattacker who is able to trigger calls to the function with crafted image\ndata (CVE-2019-6977).\n\nThe GD Graphics Library (aka LibGD) 2.2.5 has a double free in the\ngdImage*Ptr() functions in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c\n(CVE-2019-6978).\n","status":"published","published":"2019-02-13T11:08:25Z","modified":"2026-04-16T04:41:56.298616364Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"MGASA-2019-0085","title":"Updated libwmf packages fix security vulnerability","description":"The GD Graphics Library (aka LibGD) 2.2.5 has a double free in the\ngdImage*Ptr() functions in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c. NOTE:\nPHP is unaffected. (CVE-2019-6978)\n","status":"published","published":"2019-02-14T08:38:16Z","modified":"2026-04-16T04:43:39.386325085Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:1148-1","title":"Security update for gd","description":"This update for gd fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-6977: Fixed a heap-based buffer overflow the GD Graphics Library used in the imagecolormatch function (bsc#1123361).\n- CVE-2019-6978: Fixed a double free in the gdImage*Ptr() functions (bsc#1123522).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-04-04T14:15:28Z","modified":"2026-02-04T03:03:30.272171Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:10777-1","title":"gd-2.3.3-1.1 on GA media","description":"These are all security issues fixed in the gd-2.3.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:16:49.11313Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:11012-1","title":"libwmf-0_2-7-0.2.12-2.3 on GA media","description":"These are all security issues fixed in the libwmf-0_2-7-0.2.12-2.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:19.595133Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2019:0333-1","title":"Security update for php7","description":"This update for php7 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-6977: Fixed a heap-based buffer overflow the GD Graphics Library used in the imagecolormatch function (bsc#1123354).\n- CVE-2019-6978: Fixed a double free in the gdImage*Ptr() functions (bsc#1123522).\n- CVE-2018-19935: Fixed a Denial of Service in php_imap.c which could be triggered via an empty string in the message argument to imap_mail (bsc#1118832).\n","status":"published","published":"2019-02-12T11:55:36Z","modified":"2026-02-04T03:08:01.217109Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0747-1","title":"Security update for gd","description":"This update for gd fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-6977: Fixed a heap-based buffer overflow the GD Graphics Library used in the imagecolormatch function (bsc#1123361).\n- CVE-2019-6978: Fixed a double free in the gdImage*Ptr() functions (bsc#1123522).\n","status":"published","published":"2019-03-26T13:35:32Z","modified":"2026-02-04T03:50:01.590272Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0771-1","title":"Security update for gd","description":"This update for gd fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-6977: Fixed a heap-based buffer overflow the GD Graphics Library used in the imagecolormatch function (bsc#1123361).\n- CVE-2019-6978: Fixed a double free in the gdImage*Ptr() functions (bsc#1123522).\n","status":"published","published":"2019-03-27T09:36:11Z","modified":"2026-02-04T03:59:04.047137Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:13961-1","title":"Security update for php53","description":"This update for php53 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-6977: Fixed a heap-based buffer overflow the GD Graphics Library used in the imagecolormatch function (bsc#1123354).\n- CVE-2019-6978: Fixed a double free in the gdImage*Ptr() functions (bsc#1123522).\n","status":"published","published":"2019-02-14T16:25:47Z","modified":"2026-02-04T04:07:44.05602Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2022:1516-1","title":"Security update for libwmf","description":"This update for libwmf fixes the following issues:\n\nlibwmf was updated to 0.2.12:\n\n* upstream changed to fork from Fedora: https://github.com/caolanm/libwmf\n* merged all the pending fixes\n* merge in fixes for libgd CVE-2019-6978 (bsc#1123522)\n* fixed memory allocation failure (CVE-2016-9011)\n\n* Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)\n","status":"published","published":"2022-05-04T08:25:34Z","modified":"2026-02-04T04:32:35.848674Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:1560-1","title":"Security update for libwmf","description":"This update for libwmf fixes the following issues:\n\nlibwmf was updated to 0.2.12:\n\n* upstream changed to fork from Fedora: https://github.com/caolanm/libwmf\n* merged all the pending fixes\n* merge in fixes for libgd CVE-2019-6978 (bsc#1123522)\n* fixed memory allocation failure (CVE-2016-9011)\n\n* Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)\n","status":"published","published":"2022-05-06T11:41:06Z","modified":"2026-02-04T03:36:26.762116Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"USN-3900-1","title":"libgd2 vulnerabilities","description":"It was discovered that GD incorrectly handled memory when processing\ncertain images. A remote attacker could use this issue with a specially\ncrafted image file to cause GD to crash, resulting in a denial of service,\nor possibly execute arbitrary code.\n","status":"published","published":"2019-02-28T14:08:30Z","modified":"2026-04-22T09:53:33.003078Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}