{"id":"CVE-2021-40145","aliases":["ALPINE-CVE-2021-40145","AZL-6432","BELL-CVE-2021-40145","CLSA-2021-1634919016","CLSA-2021-1635439636","CLSA-2021-1635459219","CLSA-2022-1644931813","CLSA-2022-1646915745","CLSA-2026-1776445382","CLSA-2026-1777541021","CLSA-2026-1777969863","CLSA-2026-1777970160","DEBIAN-CVE-2021-40145","DLA-4411-1","EUVD-2021-27331","GHSA-8rm3-jg2c-hvfh","MGASA-2021-0433","OESA-2022-1613","UBUNTU-CVE-2021-40145","USN-5068-1"],"status":"disputed","title":"** DISPUTED ** gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has...","description":"gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has a double free. NOTE: the vendor's position is \"The GD2 image format is a proprietary image format of libgd. It has to be regarded as being obsolete, and should only be used for development and testing purposes.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02134,"percentile":0.82151,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-415"],"published":"2021-08-26T00:34:17Z","modified":"2026-10-23T18:03:32Z","fixes":[{"ecosystem":"Alpine:v3.11","package":"gd","fixed_in":["2.2.5-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"gd","fixed_in":["2.3.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"gd","fixed_in":["2.3.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"gd","fixed_in":["2.3.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"gd","fixed_in":["2.3.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"gd","fixed_in":["2.3.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"gd","fixed_in":["2.3.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"gd","fixed_in":["2.3.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"gd","fixed_in":["2.3.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"gd","fixed_in":["2.3.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"gd","fixed_in":["2.3.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"gd","fixed_in":["2.3.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"gd","fixed_in":["2.3.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"gd","fixed_in":["2.3.0-r1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"gd","fixed_in":["2.3.0-5"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"gd","fixed_in":["2.2.5-7.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"gd-devel","fixed_in":["2.2.5-7.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"gd-progs","fixed_in":["2.2.5-7.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"gd","fixed_in":["2.2.5-7.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"gd-devel","fixed_in":["2.2.5-7.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"gd-progs","fixed_in":["2.2.5-7.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"gd","fixed_in":["2.3.2-3.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"gd-devel","fixed_in":["2.3.2-3.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"gd-progs","fixed_in":["2.3.2-3.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"gd","fixed_in":["2.2.5-7.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"gd-devel","fixed_in":["2.2.5-7.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"gd-progs","fixed_in":["2.2.5-7.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"gd","fixed_in":["2.0.35-27.el7_9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"gd-devel","fixed_in":["2.0.35-27.el7_9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"gd-progs","fixed_in":["2.0.35-27.el7_9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"gd","fixed_in":["2.0.35-27.el7_9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"gd-devel","fixed_in":["2.0.35-27.el7_9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"gd-progs","fixed_in":["2.0.35-27.el7_9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libgd2","fixed_in":["2.3.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libgd2","fixed_in":["2.3.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libgd2","fixed_in":["2.3.3-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"gd","fixed_in":["2.3.0-3.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"gd","fixed_in":["2.3.0-3.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"gd","fixed_in":["2.3.0-3.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"gd","fixed_in":["2.3.2-2.oe2203"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libgd2","fixed_in":["2.1.0-3ubuntu0.11+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libgd2","fixed_in":["2.1.1-4ubuntu0.16.04.12+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libgd2","fixed_in":["2.2.5-4ubuntu0.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"libgd2","fixed_in":["2.2.5-5.2ubuntu2.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libgd2","fixed_in":["2.3.0-2ubuntu1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.11","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-r1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-5"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.35-12.el6.cloudlinux.els"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"gd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.35-12.el6.cloudlinux.els"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"gd-progs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.35-12.el6.cloudlinux.els"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.35-12.el6.cloudlinux.els"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"gd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.35-12.el6.cloudlinux.els"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"gd-progs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.35-12.el6.cloudlinux.els"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libgd-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-4ubuntu0.16.04.13"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libgd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-4ubuntu0.16.04.13"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libgd3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-4ubuntu0.16.04.13"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-7.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"gd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-7.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"gd-progs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-7.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-7.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"gd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-7.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"gd-progs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-7.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2-3.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2-3.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gd-progs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2-3.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-7.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"gd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-7.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"gd-progs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-7.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.35-27.el7_9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"gd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.35-27.el7_9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"gd-progs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.35-27.el7_9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.35-27.el7_9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"gd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.35-27.el7_9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"gd-progs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.35-27.el7_9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libgd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libgd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libgd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"libgd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-2+deb11u1"}]}],"versions":["2.3.0-2"],"bundled":3},{"source":"osv","ecosystem":"Mageia:8","package":"libgd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-1.1.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-3.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-3.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-3.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2-2.oe2203"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libgd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-3ubuntu0.11+esm2"}]}],"versions":["2.1.0-2","2.1.0-3","2.1.0-3ubuntu0.1","2.1.0-3ubuntu0.2","2.1.0-3ubuntu0.3","2.1.0-3ubuntu0.5","2.1.0-3ubuntu0.6","2.1.0-3ubuntu0.7","2.1.0-3ubuntu0.8","2.1.0-3ubuntu0.10","2.1.0-3ubuntu0.11","2.1.0-3ubuntu0.11+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libgd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-4ubuntu0.16.04.12+esm1"}]}],"versions":["2.1.1-4build1","2.1.1-4build2","2.1.1-4ubuntu0.16.04.1","2.1.1-4ubuntu0.16.04.2","2.1.1-4ubuntu0.16.04.3","2.1.1-4ubuntu0.16.04.5","2.1.1-4ubuntu0.16.04.6","2.1.1-4ubuntu0.16.04.7","2.1.1-4ubuntu0.16.04.8","2.1.1-4ubuntu0.16.04.10","2.1.1-4ubuntu0.16.04.11","2.1.1-4ubuntu0.16.04.12"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libgd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-4ubuntu0.5"}]}],"versions":["2.2.5-3","2.2.5-4","2.2.5-4ubuntu0.2","2.2.5-4ubuntu0.3","2.2.5-4ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libgd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-5.2ubuntu2.1"}]}],"versions":["2.2.5-5.2","2.2.5-5.2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libgd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-2ubuntu1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libgd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-3ubuntu0.11+esm2"}]}],"versions":["2.1.0-2","2.1.0-3","2.1.0-3ubuntu0.1","2.1.0-3ubuntu0.2","2.1.0-3ubuntu0.3","2.1.0-3ubuntu0.5","2.1.0-3ubuntu0.6","2.1.0-3ubuntu0.7","2.1.0-3ubuntu0.8","2.1.0-3ubuntu0.10","2.1.0-3ubuntu0.11","2.1.0-3ubuntu0.11+esm1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libgd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-4ubuntu0.16.04.12+esm1"}]}],"versions":["2.1.1-4build1","2.1.1-4build2","2.1.1-4ubuntu0.16.04.1","2.1.1-4ubuntu0.16.04.2","2.1.1-4ubuntu0.16.04.3","2.1.1-4ubuntu0.16.04.5","2.1.1-4ubuntu0.16.04.6","2.1.1-4ubuntu0.16.04.7","2.1.1-4ubuntu0.16.04.8","2.1.1-4ubuntu0.16.04.10","2.1.1-4ubuntu0.16.04.11","2.1.1-4ubuntu0.16.04.12"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libgd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-4ubuntu0.5"}]}],"versions":["2.2.5-3","2.2.5-4","2.2.5-4ubuntu0.2","2.2.5-4ubuntu0.3","2.2.5-4ubuntu0.4"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libgd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-5.2ubuntu2.1"}]}],"versions":["2.2.5-5.2","2.2.5-5.2ubuntu2"],"bundled":3}],"products":[{"vendor":"libgd","product":"libgd"}],"references":[{"url":"https://github.com/libgd/libgd/commit/c5fd25ce0e48fd5618a972ca9f5e28d6d62006af","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://github.com/libgd/libgd/pull/713","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://github.com/libgd/libgd/issues/700","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-40145","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-8rm3-jg2c-hvfh"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-40145","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-40145","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ol6/CLSA-2021-1634919016.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/els6/CLSA-2021-1635439636.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16_04/CLSA-2021-1635459219","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2022-1644931813.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.5-els/CLSA-2022-1646915745.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1776445382.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1777541021.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1777969863.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1777970160.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-40145","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0433.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29448","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5068-1","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1613","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-40145","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-40145","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-6363","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-38115","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-40145","description":"gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has a double free. NOTE: the vendor's position is \"The GD2 image format is a proprietary image format of libgd. It has to be regarded as being obsolete, and should only be used for development and testing purposes.","status":"disputed","published":"2021-08-26T00:34:17Z","modified":"2024-08-04T02:27:31.617Z","updated_at":"2026-11-02T14:33:01.495293Z"}],"euvd":[{"id":"EUVD-2021-27331","description":"gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has a double free. NOTE: the vendor's position is \"The GD2 image format is a proprietary image format of libgd. It has to be regarded as being obsolete, and should only be used for development and testing purposes.","status":"published","published":"2021-08-26T00:34:17Z","modified":"2024-08-04T02:27:31Z","updated_at":"2026-11-03T03:24:21.368958Z"}],"ghsa":[{"id":"GHSA-8rm3-jg2c-hvfh","title":"** DISPUTED ** gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has...","description":"** DISPUTED ** gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has a double free. NOTE: the vendor's position is \"The GD2 image format is a proprietary image format of libgd. It has to be regarded as being obsolete, and should only be used for development and testing purposes.\"","status":"published","published":"2022-05-24T19:12:21Z","modified":"2024-03-30T05:01:43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T14:55:45.190481Z"}],"nvd":[{"id":"CVE-2021-40145","description":"gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has a double free. NOTE: the vendor's position is \"The GD2 image format is a proprietary image format of libgd. It has to be regarded as being obsolete, and should only be used for development and testing purposes.","status":"disputed","published":"2021-08-26T01:15:11.747Z","modified":"2026-06-17T04:06:35.353Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T14:06:57.67549Z"}],"osv":[{"id":"ALPINE-CVE-2021-40145","description":"gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has a double free. NOTE: the vendor's position is \"The GD2 image format is a proprietary image format of libgd. It has to be regarded as being obsolete, and should only be used for development and testing purposes.","status":"published","published":"2021-08-26T01:15:11.747Z","modified":"2026-10-23T17:17:56.208962573Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:48.646074Z"},{"id":"AZL-6432","title":"CVE-2021-40145 affecting package gd for versions less than 2.3.0-5","description":"gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has a double free. NOTE: the vendor's position is \"The GD2 image format is a proprietary image format of libgd. It has to be regarded as being obsolete, and should only be used for development and testing purposes.","status":"published","published":"2021-08-26T01:15:11Z","modified":"2026-04-21T04:32:21.743923Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:07.805289Z"},{"id":"BELL-CVE-2021-40145","title":"CVE-2021-40145 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:55.798786Z","modified":"2026-09-06T07:15:10.389390566Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:16.5265Z"},{"id":"CVE-2021-40145","description":"gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has a double free. NOTE: the vendor's position is \"The GD2 image format is a proprietary image format of libgd. It has to be regarded as being obsolete, and should only be used for development and testing purposes.","status":"published","published":"2021-08-26T01:15:11.747Z","modified":"2026-10-20T10:54:55.610247795Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:21.249056Z"},{"id":"DEBIAN-CVE-2021-40145","description":"gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has a double free. NOTE: the vendor's position is \"The GD2 image format is a proprietary image format of libgd. It has to be regarded as being obsolete, and should only be used for development and testing purposes.","status":"published","published":"2021-08-26T01:15:11.747Z","modified":"2026-10-23T18:03:32.666620309Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:35.521549Z"},{"id":"OESA-2022-1613","title":"gd security update","description":"The gd graphics library allows your code to quickly draw images complete with lines, arcs, text, multiple colors, cut and paste from other images, and flood fills, and to write out the result as a PNG or JPEG file. The most common applications of GD involve website development, although it can be used with any standalone application!\r\n\r\nSecurity Fix(es):\r\n\r\n** DISPUTED ** gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has a double free. NOTE: the vendor\u0026apos;s position is \u0026quot;The GD2 image format is a proprietary image format of libgd. It has to be regarded as being obsolete, and should only be used for development and testing purposes.\u0026quot;(CVE-2021-40145)","status":"published","published":"2022-04-16T11:04:53Z","modified":"2026-08-18T01:16:29.08315457Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"UBUNTU-CVE-2021-40145","description":"gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has a double free. NOTE: the vendor's position is \"The GD2 image format is a proprietary image format of libgd. It has to be regarded as being obsolete, and should only be used for development and testing purposes.","status":"published","published":"2021-08-26T01:15:00Z","modified":"2026-04-22T12:59:57.520156Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:28.526929Z"},{"id":"CLSA-2021-1634919016","title":"Fixed CVEs in gd: CVE-2017-6363, CVE-2021-40145","description":"- CVE-2021-40145: check for memory allocation errors processing GD2 images\n- CVE-2017-6363: make sure transparent index is within bounds of the palette","status":"published","published":"2021-10-22T16:10:16Z","modified":"2026-06-01T00:31:35.98871169Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CLSA-2021-1635439636","title":"Fix of CVE: CVE-2017-6363, CVE-2021-40145","description":"- CVE-2021-40145: check for memory allocation errors processing GD2 images\n- CVE-2017-6363: make sure transparent index is within bounds of the palette","status":"published","published":"2021-10-28T16:47:16Z","modified":"2026-06-01T00:32:13.838828805Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CLSA-2021-1635459219","title":"Fix CVE(s): CVE-2021-40812, CVE-2021-40145, CVE-2021-38115, CVE-2017-6363","description":"\n   * SECURITY UPDATE: unhandled memory allocation error in gdImageGd2Ptr\n     - debian/patches/CVE-2021-40145.patch: check for non-zero return\n       code from _gdImageGd2\n     - CVE-2021-40145\n   * SECURITY UPDATE: unhandled value returned from gdPutBuf\n     - debian/patches/CVE-2021-40812.patch: handle possible gdPutBuf\n       error in _gdImageBmpCtx and _gdImageWebpCtx\n       CVE-2021-40812\n   * SECURITY UPDATE: unhandled value returned from gdGetBuf\n     - debian/patches/CVE-2021-38115.patch: handle possible gdGetBuf\n       error in read_header_tga\n       CVE-2021-38115\n   * SECURITY UPDATE: handle possible heap buffer overread\n     - debian/patches/CVE-2017-6363.patch: make sure transparent\n       index is within bounds of the palette\n       CVE-2017-6363","status":"published","published":"2021-10-28T22:13:39Z","modified":"2026-06-04T10:03:25.925809666Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CLSA-2022-1644931813","title":"Fix of CVE: CVE-2021-40145","description":"- CVE-2021-40145: Fix a double free","status":"published","published":"2022-02-15T13:30:13Z","modified":"2026-06-01T00:33:19.070596835Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CLSA-2022-1646915745","title":"Fix of CVE: CVE-2021-40145","description":"- CVE-2021-40145: Fix a double free in gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library","status":"published","published":"2022-03-10T12:35:45Z","modified":"2026-06-01T00:33:20.185075535Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CLSA-2026-1776445382","title":"gd: Fix of CVE-2021-40145","description":"- Fix CVE-2021-40145: double-free in gdImageGd2Ptr()","status":"published","published":"2026-04-17T17:03:07Z","modified":"2026-06-01T00:32:23.594368565Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1777541021","title":"gd: Fix of CVE-2021-40145","description":"- CVE-2021-40145: Fix a double free in gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library","status":"published","published":"2026-04-30T09:23:46Z","modified":"2026-06-01T00:33:14.365995689Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777969863","title":"gd: Fix of CVE-2021-40145","description":"- CVE-2021-40145: fix double free in gdImageGd2Ptr","status":"published","published":"2026-05-05T08:31:13Z","modified":"2026-06-01T00:33:27.384931029Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1777970160","title":"gd: Fix of CVE-2021-40145","description":"- CVE-2021-40145: fix double free in gdImageGd2Ptr","status":"published","published":"2026-05-05T08:36:07Z","modified":"2026-06-01T00:33:28.231265603Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"DLA-4411-1","title":"libgd2 - security update","status":"published","published":"2025-12-16T00:00:00Z","modified":"2025-12-16T08:44:58.453734Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2021-0433","title":"Updated libgd packages fix security vulnerability","description":"read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through\n2.3.2 allows remote attackers to cause a denial of service (out-of-bounds\nread) via a crafted TGA file. (CVE-2021-38115)\n\ngdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through\n2.3.2 has a double free. (CVE-2021-40145)\n","status":"published","published":"2021-09-23T04:49:29Z","modified":"2026-04-16T04:40:38.761785511Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"USN-5068-1","title":"libgd2 vulnerabilities","description":"It was discovered that GD Graphics Library incorrectly handled certain GD  and GD2 files.\nAn attacker could possibly use this issue to cause a crash or expose sensitive information.\nThis issue only affected Ubuntu 20.04 LTS, Ubuntu 18.04 LTS, Ubuntu 16.04 ESM, and Ubuntu 14.04 ESM.\n(CVE-2017-6363)\n\nIt was discovered that GD Graphics Library incorrectly handled certain TGA files.\nAn attacker could possibly use this issue to cause a denial of service or\nexpose sensitive information. (CVE-2021-381)\n\nIt was discovered that GD Graphics Library incorrectly handled certain files.\nAn attacker could possibly use this issue to cause a crash.\n(CVE-2021-40145)\n","status":"published","published":"2021-09-08T13:08:35Z","modified":"2026-06-29T13:49:31.877546793Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}