Ubuntu 3213-1: GD library vulnerabilities

    Date28 Feb 2017
    CategoryUbuntu
    96
    Posted ByLinuxSecurity Advisories
    The GD library could be made to crash or run programs if it processed a specially crafted image file.
    ==========================================================================
    Ubuntu Security Notice USN-3213-1
    February 28, 2017
    
    libgd2 vulnerabilities
    ==========================================================================
    
    A security issue affects these releases of Ubuntu and its derivatives:
    
    - Ubuntu 16.10
    - Ubuntu 16.04 LTS
    - Ubuntu 14.04 LTS
    - Ubuntu 12.04 LTS
    
    Summary:
    
    The GD library could be made to crash or run programs if it processed a
    specially crafted image file.
    
    Software Description:
    - libgd2: GD Graphics Library
    
    Details:
    
    Stefan Esser discovered that the GD library incorrectly handled memory when
    processing certain images. If a user or automated system were tricked into
    processing a specially crafted image, an attacker could cause a denial of
    service, or possibly execute arbitrary code. This issue only affected
    Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-10166)
    
    It was discovered that the GD library incorrectly handled certain malformed
    images. If a user or automated system were tricked into processing a
    specially crafted image, an attacker could cause a denial of service.
    (CVE-2016-10167)
    
    It was discovered that the GD library incorrectly handled certain malformed
    images. If a user or automated system were tricked into processing a
    specially crafted image, an attacker could cause a denial of service, or
    possibly execute arbitrary code. (CVE-2016-10168)
    
    Ibrahim El-Sayed discovered that the GD library incorrectly handled certain
    malformed TGA images. If a user or automated system were tricked into
    processing a specially crafted TGA image, an attacker could cause a denial
    of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and
    Ubuntu 16.10. (CVE-2016-6906)
    
    Ibrahim El-Sayed discovered that the GD library incorrectly handled certain
    malformed WebP images. If a user or automated system were tricked into
    processing a specially crafted WebP image, an attacker could cause a denial
    of service, or possibly execute arbitrary code. This issue only affected
    Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-6912)
    
    It was discovered that the GD library incorrectly handled creating
    oversized images. If a user or automated system were tricked into creating
    a specially crafted image, an attacker could cause a denial of service.
    (CVE-2016-9317)
    
    It was discovered that the GD library incorrectly handled filling certain
    images. If a user or automated system were tricked into filling an image,
    an attacker could cause a denial of service. (CVE-2016-9933)
    
    Update instructions:
    
    The problem can be corrected by updating your system to the following
    package versions:
    
    Ubuntu 16.10:
      libgd3                          2.2.1-1ubuntu3.3
    
    Ubuntu 16.04 LTS:
      libgd3                          2.1.1-4ubuntu0.16.04.6
    
    Ubuntu 14.04 LTS:
      libgd3                          2.1.0-3ubuntu0.6
    
    Ubuntu 12.04 LTS:
      libgd2-noxpm                    2.0.36~rc1~dfsg-6ubuntu2.4
      libgd2-xpm                      2.0.36~rc1~dfsg-6ubuntu2.4
    
    In general, a standard system update will make all the necessary changes.
    
    References:
      http://www.ubuntu.com/usn/usn-3213-1
      CVE-2016-10166, CVE-2016-10167, CVE-2016-10168, CVE-2016-6906,
      CVE-2016-6912, CVE-2016-9317, CVE-2016-9933
    
    Package Information:
      https://launchpad.net/ubuntu/+source/libgd2/2.2.1-1ubuntu3.3
      https://launchpad.net/ubuntu/+source/libgd2/2.1.1-4ubuntu0.16.04.6
      https://launchpad.net/ubuntu/+source/libgd2/2.1.0-3ubuntu0.6
      https://launchpad.net/ubuntu/+source/libgd2/2.0.36~rc1~dfsg-6ubuntu2.4
    
    
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"36","type":"x","order":"1","pct":50.7,"resources":[]},{"id":"88","title":"Should be more technical","votes":"10","type":"x","order":"2","pct":14.08,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"25","type":"x","order":"3","pct":35.21,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.