Ubuntu 16.04 LTS USN-3213-1: libgd Denial of Service Issues

ubuntu

February 28, 2017

The GD library could be made to crash or run programs if it processed a specially crafted image file.

Summary

The GD library could be made to crash or run programs if it processed a

specially crafted image file.

Software Description:

- libgd2: GD Graphics Library

Details:

Stefan Esser discovered that the GD library incorrectly handled memory when

processing certain images. If a user or automated system were tricked into

processing a specially crafted image, an attacker could cause a denial of

service, or possibly execute arbitrary code. This issue only affected

Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-10166)

It was discovered that the GD library incorrectly handled certain malformed

images. If a user or automated system were tricked into processing a

specially crafted image, an attacker could cause a denial of service.

(CVE-2016-10167)

It was discovered that the GD library incorrectly handled certain malformed

images. If a user or automated system were tricked into processing a

specially crafted image, an attacker could cause a denial of ser...

Read the Full Advisory

Topics Covered

security advisory denial of service security issue software update libgd2 Ubuntu 16.04

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.10:
  libgd3                          2.2.1-1ubuntu3.3

Ubuntu 16.04 LTS:
  libgd3                          2.1.1-4ubuntu0.16.04.6

Ubuntu 14.04 LTS:
  libgd3                          2.1.0-3ubuntu0.6

Ubuntu 12.04 LTS:
  libgd2-noxpm                    2.0.36~rc1~dfsg-6ubuntu2.4
  libgd2-xpm                      2.0.36~rc1~dfsg-6ubuntu2.4

In general, a standard system update will make all the necessary changes.