Ubuntu 3213-1: GD library vulnerabilities

    Date28 Feb 2017
    196
    Posted ByLinuxSecurity Advisories
    The GD library could be made to crash or run programs if it processed a specially crafted image file.
    ==========================================================================
    Ubuntu Security Notice USN-3213-1
    February 28, 2017
    
    libgd2 vulnerabilities
    ==========================================================================
    
    A security issue affects these releases of Ubuntu and its derivatives:
    
    - Ubuntu 16.10
    - Ubuntu 16.04 LTS
    - Ubuntu 14.04 LTS
    - Ubuntu 12.04 LTS
    
    Summary:
    
    The GD library could be made to crash or run programs if it processed a
    specially crafted image file.
    
    Software Description:
    - libgd2: GD Graphics Library
    
    Details:
    
    Stefan Esser discovered that the GD library incorrectly handled memory when
    processing certain images. If a user or automated system were tricked into
    processing a specially crafted image, an attacker could cause a denial of
    service, or possibly execute arbitrary code. This issue only affected
    Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-10166)
    
    It was discovered that the GD library incorrectly handled certain malformed
    images. If a user or automated system were tricked into processing a
    specially crafted image, an attacker could cause a denial of service.
    (CVE-2016-10167)
    
    It was discovered that the GD library incorrectly handled certain malformed
    images. If a user or automated system were tricked into processing a
    specially crafted image, an attacker could cause a denial of service, or
    possibly execute arbitrary code. (CVE-2016-10168)
    
    Ibrahim El-Sayed discovered that the GD library incorrectly handled certain
    malformed TGA images. If a user or automated system were tricked into
    processing a specially crafted TGA image, an attacker could cause a denial
    of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and
    Ubuntu 16.10. (CVE-2016-6906)
    
    Ibrahim El-Sayed discovered that the GD library incorrectly handled certain
    malformed WebP images. If a user or automated system were tricked into
    processing a specially crafted WebP image, an attacker could cause a denial
    of service, or possibly execute arbitrary code. This issue only affected
    Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-6912)
    
    It was discovered that the GD library incorrectly handled creating
    oversized images. If a user or automated system were tricked into creating
    a specially crafted image, an attacker could cause a denial of service.
    (CVE-2016-9317)
    
    It was discovered that the GD library incorrectly handled filling certain
    images. If a user or automated system were tricked into filling an image,
    an attacker could cause a denial of service. (CVE-2016-9933)
    
    Update instructions:
    
    The problem can be corrected by updating your system to the following
    package versions:
    
    Ubuntu 16.10:
      libgd3                          2.2.1-1ubuntu3.3
    
    Ubuntu 16.04 LTS:
      libgd3                          2.1.1-4ubuntu0.16.04.6
    
    Ubuntu 14.04 LTS:
      libgd3                          2.1.0-3ubuntu0.6
    
    Ubuntu 12.04 LTS:
      libgd2-noxpm                    2.0.36~rc1~dfsg-6ubuntu2.4
      libgd2-xpm                      2.0.36~rc1~dfsg-6ubuntu2.4
    
    In general, a standard system update will make all the necessary changes.
    
    References:
      https://www.ubuntu.com/usn/usn-3213-1
      CVE-2016-10166, CVE-2016-10167, CVE-2016-10168, CVE-2016-6906,
      CVE-2016-6912, CVE-2016-9317, CVE-2016-9933
    
    Package Information:
      https://launchpad.net/ubuntu/+source/libgd2/2.2.1-1ubuntu3.3
      https://launchpad.net/ubuntu/+source/libgd2/2.1.1-4ubuntu0.16.04.6
      https://launchpad.net/ubuntu/+source/libgd2/2.1.0-3ubuntu0.6
      https://launchpad.net/ubuntu/+source/libgd2/2.0.36~rc1~dfsg-6ubuntu2.4
    
    
    

    LinuxSecurity Poll

    What do you think of the LinuxSecurity Privacy news articles?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/25-what-do-you-think-of-the-linuxsecurity-privacy-news-articles?task=poll.vote&format=json
    25
    radio
    [{"id":"90","title":"Love them!","votes":"93","type":"x","order":"1","pct":79.49,"resources":[]},{"id":"91","title":"I'm indifferent","votes":"18","type":"x","order":"2","pct":15.38,"resources":[]},{"id":"92","title":"Not interested in this topic","votes":"6","type":"x","order":"3","pct":5.13,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.