Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found 9 articles for you...
89
security advisorybuffer overflowFedoraFedora 31 Security Advisory: gd Library Buffer Overflow and Free Error
fixed multiple security bugs. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2019-7a06c0e6b4 2019-11-18 22:47:05.646015 --------------------------------------------------------------------------------Name : gd Product : Fedora 31 Version : 2.2.5 Release : 10.fc31 URL : https://libgd.github.io/ Summary : A graphics library for quick creation of PNG or JPEG images Description : The gd graphics library allows your code to quickly draw images complete with lines, arcs, text, multiple colors, cut and paste from other images, and flood fills, and to write out the result as a PNG or JPEG file. This is particularly useful in Web applications, where PNG and JPEG are two of the formats accepted for inline images by most browsers. Note that gd is not a paint program. --------------------------------------------------------------------------------Update Information: fixed multiple security bugs --------------------------------------------------------------------------------ChangeLog: * Fri Nov 1 2019
Nov 18, 2019
•Important
Fedora
202
security advisorymoderate severityheap overflowopenSUSE Leap 42.3: 2019:1140-1 Moderate: GD Buffer Overflow Fix
An update that fixes two vulnerabilities is now available.. openSUSE Security Update: Security update for gd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1140-1 Rating: moderate References: #1123361 #1123522 Cross-References: CVE-2019-6977 CVE-2019-6978 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for gd fixes the following issues: Security issues fixed: - CVE-2019-6977: Fixed a heap-based buffer overflow the GD Graphics Library used in the imagecolormatch function (bsc#1123361). - CVE-2019-6978: Fixed a double free in the gdImage*Ptr() functions (bsc#1123522). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-1140=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): gd-2.1.0-30.1 gd-debuginfo-2.1.0-30.1 gd-debugsource-2.1.0-30.1 gd-devel-2.1.0-30.1 - openSUSE Leap 42.3 (x86_64): gd-32bit-2.1.0-30.1 gd-debuginfo-32bit-2.1.0-30.1 References: https://www.suse.com/security/cve/CVE-2019-6977.html https://www.suse.com/security/cve/CVE-2019-6978.html https://bugzilla.suse.com/1123361 https://bugzilla.suse.com/1123522 -- . This patch resolves significant vulnerabilities within the GD Library on openSUSE, focusing on heap overflow exploits and memory handling improvements.. openSUSE Security Update, gd library, patch instructions, heap overflow fix. . LinuxSecurity.com Team
Apr 04, 2019
OpenSUSE
202
security advisorymoderate severityheap overflowopenSUSE Leap 15.0: 2019:1148-1 Moderate: gd Memory Issues
An update that fixes two vulnerabilities is now available.. openSUSE Security Update: Security update for gd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1148-1 Rating: moderate References: #1123361 #1123522 Cross-References: CVE-2019-6977 CVE-2019-6978 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for gd fixes the following issues: Security issues fixed: - CVE-2019-6977: Fixed a heap-based buffer overflow the GD Graphics Library used in the imagecolormatch function (bsc#1123361). - CVE-2019-6978: Fixed a double free in the gdImage*Ptr() functions (bsc#1123522). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-1148=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): gd-2.2.5-lp150.8.1 gd-debuginfo-2.2.5-lp150.8.1 gd-debugsource-2.2.5-lp150.8.1 gd-devel-2.2.5-lp150.8.1 libgd3-2.2.5-lp150.8.1 libgd3-debuginfo-2.2.5-lp150.8.1 - openSUSE Leap 15.0 (x86_64): libgd3-32bit-2.2.5-lp150.8.1 libgd3-32bit-debuginfo-2.2.5-lp150.8.1 References: https://www.suse.com/security/cve/CVE-2019-6977.html https://www.suse.com/security/cve/CVE-2019-6978.html https://bugzilla.suse.com/1123361 https://bugzilla.suse.com/1123522 -- . The latest patch for gd tackles two significant vulnerabilities: a buffer overflow and a memory leak. Crucial for Fedora users.. openSUSE Security Update, gd vulnerabilities, openSUSE patch. . LinuxSecurity.com Team
Apr 04, 2019
OpenSUSE
91
security advisorydenial of servicegentooGentoo: GLSA-201903-18 Normal: GD Image Processing Multiple Exploits
Multiple vulnerabilities have been found in GD, the worst of which could result in the remote execution of arbitrary code.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201903-18 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: GD: Multiple vulnerabilities Date: March 28, 2019 Bugs: #664732, #679702 ID: 201903-18 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple vulnerabilities have been found in GD, the worst of which could result in the remote execution of arbitrary code. Background ========= GD is a graphic library for fast image creation. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 media-libs/gd < 2.2.5-r2 > = 2.2.5-r2 Description ========== Multiple vulnerabilities have been discovered in GD. Please review the CVE identifiers referenced below for details. Impact ===== A remote attacker could entice a user to process a specially crafted image, possibly resulting in execution of arbitrary code or a Denial of Service condition. Workaround ========= There is no known workaround at this time. Resolution ========= All GD users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =media-libs/gd-2.2.5-r2" References ========= [ 1 ] CVE-2018-1000222 https://nvd.nist.gov/vuln/detail/CVE-2018-1000222 [ 2 ] CVE-2018-5711 https://nvd.nist.gov/vuln/detail/CVE-2018-5711 [ 3 ] CVE-2019-6977 https://nvd.nist.gov/vuln/detail/CVE-2019-6977 [ 4 ] CVE-2019-6978 https://nvd.nist.gov/vuln/detail/CVE-2019-6978 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201903-18 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
Mar 27, 2019
Gentoo
89
security advisorycriticalFedoraFedora 25: 2017-a69b0bb52d Critical: gd Double-Free and Buffer Problems
**Version 2.2.5** - 2017-08-30 * **Security** - Double-free in gdImagePngPtr(). **CVE-2017-6362** - Buffer over-read into uninitialized memory. **CVE-2017-7890** * **Fixed** - Fix #109: XBM reading fails with printed error - Fix #338: Fatal and normal libjpeg/ibpng errors not distinguishable - Fix #357: 2.2.4: Segfault in test suite - Fix #386:. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2017-a69b0bb52d 2017-09-06 13:04:00.527143 --------------------------------------------------------------------------------Name : gd Product : Fedora 25 Version : 2.2.5 Release : 1.fc25 URL : https://libgd.github.io/ Summary : A graphics library for quick creation of PNG or JPEG images Description : The gd graphics library allows your code to quickly draw images complete with lines, arcs, text, multiple colors, cut and paste from other images, and flood fills, and to write out the result as a PNG or JPEG file. This is particularly useful in Web applications, where PNG and JPEG are two of the formats accepted for inline images by most browsers. Note that gd is not a paint program. --------------------------------------------------------------------------------Update Information: **Version 2.2.5** - 2017-08-30 * **Security** - Double-free in gdImagePngPtr(). **CVE-2017-6362** - Buffer over-read into uninitialized memory. **CVE-2017-7890** * **Fixed** - Fix #109: XBM reading fails with printed error - Fix #338: Fatal and normal libjpeg/ibpng errors not distinguishable - Fix #357: 2.2.4: Segfault in test suite - Fix #386: gdImageGrayScale() may produce colors - Fix #406: webpng -i removes the transparent color - Fix Coverity #155475: Failure to restore alphaBlendingFlag - Fix Coverity #155476: potential resource leak - Fix several build issues and test failures - Fix and reenable optimized support for reading 1 bpsTIFFs --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade gd' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Sep 06, 2017
•Critical
Fedora
89
security advisoryFedoraDoSFedora 24: 2017-2717b02630 Critical: gd Image Processing DoS Threats
## Version 2.2.4 - 2017-01-18 ### Security - gdImageCreate() doesn't check for oversized images and as such is prone to DoS vulnerabilities. (CVE-2016-9317) - double-free in gdImageWebPtr() (CVE-2016-6912) - potential unsigned underflow in gd_interpolation.c - DOS vulnerability in gdImageCreateFromGd2Ctx() ### Fixed - Fix #354: Signed Integer Overflow gd_io.c - Fix #340: System frozen -. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2017-2717b02630 2017-01-23 23:54:30.270365 -------------------------------------------------------------------------------- Name : gd Product : Fedora 24 Version : 2.2.4 Release : 1.fc24 URL : https://libgd.github.io/ Summary : A graphics library for quick creation of PNG or JPEG images Description : The gd graphics library allows your code to quickly draw images complete with lines, arcs, text, multiple colors, cut and paste from other images, and flood fills, and to write out the result as a PNG or JPEG file. This is particularly useful in Web applications, where PNG and JPEG are two of the formats accepted for inline images by most browsers. Note that gd is not a paint program. -------------------------------------------------------------------------------- Update Information: ## Version 2.2.4 - 2017-01-18 ### Security - gdImageCreate() doesn't check for oversized images and as such is prone to DoS vulnerabilities. (CVE-2016-9317) - double-free in gdImageWebPtr() (CVE-2016-6912) - potential unsigned underflow in gd_interpolation.c - DOS vulnerability in gdImageCreateFromGd2Ctx() ### Fixed - Fix #354: Signed Integer Overflow gd_io.c - Fix #340: System frozen - Fix OOB reads of the TGA decompression buffer - Fix DOS vulnerability in gdImageCreateFromGd2Ctx() - Fix potential unsigned underflow - Fix double-free in gdImageWebPtr() - Fix invalid read in gdImageCreateFromTiffPtr() - Fix OOB reads of the TGA decompression buffer - Fix #68: gif: buffer underflow reported byAddressSanitizer - Avoid potentially dangerous signed to unsigned conversion - Fix #304: test suite failure in gif/bug00006 [2.2.3] - Fix #329: GD_BILINEAR_FIXED gdImageScale() can cause black border - Fix #330: Integer overflow in gdImageScaleBilinearPalette() - Fix 321: Null pointer dereferences in gdImageRotateInterpolated - Fix whitespace and add missing comment block - Fix #319: gdImageRotateInterpolated can have wrong background color - Fix color quantization documentation - Fix #309: gdImageGd2() writes wrong chunk sizes on boundaries - Fix #307: GD_QUANT_NEUQUANT fails to unset trueColor flag - Fix #300: gdImageClone() assigns res_y = res_x - Fix #299: Regression regarding gdImageRectangle() with gdImageSetThickness() - Replace GNU old-style field designators with C89 compatible initializers - Fix #297: gdImageCrop() converts palette image to truecolor image - Fix #290: TGA RLE decoding is broken - Fix unnecessary non NULL checks - Fix #289: Passing unrecognized formats to gdImageGd2 results in corrupted files - Fix #280: gdImageWebpEx() `quantization` parameter is a misnomer - Publish all gdImageCreateFromWebp*() functions and gdImageWebpCtx() - Fix issue #276: Sometimes pixels are missing when storing images as BMPs - Fix issue #275: gdImageBmpCtx() may segfault for non-seekable contexts - Fix copy&paste error in gdImageScaleBicubicFixed() ### Added - More documentation - Documentation on GD and GD2 formats - More tests -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade gd' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Jan 24, 2017
•Critical
Fedora
89
security advisoryfedoraupdateFedora 25: 2017-bab5698540 Critical: gd Library DoS Issues Resolved
## Version 2.2.4 - 2017-01-18 ### Security - gdImageCreate() doesn't check for oversized images and as such is prone to DoS vulnerabilities. (CVE-2016-9317) - double-free in gdImageWebPtr() (CVE-2016-6912) - potential unsigned underflow in gd_interpolation.c - DOS vulnerability in gdImageCreateFromGd2Ctx() ### Fixed - Fix #354: Signed Integer Overflow gd_io.c - Fix #340: System frozen -. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2017-bab5698540 2017-01-23 23:54:29.226277 -------------------------------------------------------------------------------- Name : gd Product : Fedora 25 Version : 2.2.4 Release : 1.fc25 URL : https://libgd.github.io/ Summary : A graphics library for quick creation of PNG or JPEG images Description : The gd graphics library allows your code to quickly draw images complete with lines, arcs, text, multiple colors, cut and paste from other images, and flood fills, and to write out the result as a PNG or JPEG file. This is particularly useful in Web applications, where PNG and JPEG are two of the formats accepted for inline images by most browsers. Note that gd is not a paint program. -------------------------------------------------------------------------------- Update Information: ## Version 2.2.4 - 2017-01-18 ### Security - gdImageCreate() doesn't check for oversized images and as such is prone to DoS vulnerabilities. (CVE-2016-9317) - double-free in gdImageWebPtr() (CVE-2016-6912) - potential unsigned underflow in gd_interpolation.c - DOS vulnerability in gdImageCreateFromGd2Ctx() ### Fixed - Fix #354: Signed Integer Overflow gd_io.c - Fix #340: System frozen - Fix OOB reads of the TGA decompression buffer - Fix DOS vulnerability in gdImageCreateFromGd2Ctx() - Fix potential unsigned underflow - Fix double-free in gdImageWebPtr() - Fix invalid read in gdImageCreateFromTiffPtr() - Fix OOB reads of the TGA decompression buffer - Fix #68: gif: buffer underflow reported byAddressSanitizer - Avoid potentially dangerous signed to unsigned conversion - Fix #304: test suite failure in gif/bug00006 [2.2.3] - Fix #329: GD_BILINEAR_FIXED gdImageScale() can cause black border - Fix #330: Integer overflow in gdImageScaleBilinearPalette() - Fix 321: Null pointer dereferences in gdImageRotateInterpolated - Fix whitespace and add missing comment block - Fix #319: gdImageRotateInterpolated can have wrong background color - Fix color quantization documentation - Fix #309: gdImageGd2() writes wrong chunk sizes on boundaries - Fix #307: GD_QUANT_NEUQUANT fails to unset trueColor flag - Fix #300: gdImageClone() assigns res_y = res_x - Fix #299: Regression regarding gdImageRectangle() with gdImageSetThickness() - Replace GNU old-style field designators with C89 compatible initializers - Fix #297: gdImageCrop() converts palette image to truecolor image - Fix #290: TGA RLE decoding is broken - Fix unnecessary non NULL checks - Fix #289: Passing unrecognized formats to gdImageGd2 results in corrupted files - Fix #280: gdImageWebpEx() `quantization` parameter is a misnomer - Publish all gdImageCreateFromWebp*() functions and gdImageWebpCtx() - Fix issue #276: Sometimes pixels are missing when storing images as BMPs - Fix issue #275: gdImageBmpCtx() may segfault for non-seekable contexts - Fix copy&paste error in gdImageScaleBicubicFixed() ### Added - More documentation - Documentation on GD and GD2 formats - More tests -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade gd' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Jan 24, 2017
•Critical
Fedora
89
security advisoryfedorabuffer overflowFedora 24 GD Update: FEDORA-2016-e45a7e7b13 Critical Buffer Overflow
- Security fix for CVE-2016-8670 - Security fix for CVE-2016-6911 - Security fix for CVE-2016-7568 - For Fedora 26 disabled two tests - they are failing because of freetype 2.7 (https://github.com/libgd/libgd/issues/302, https://github.com/libgd/libgd/issues/217). -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2016-e45a7e7b13 2016-12-16 17:01:08.503809 -------------------------------------------------------------------------------- Name : gd Product : Fedora 24 Version : 2.2.3 Release : 5.fc24 URL : https://libgd.github.io/ Summary : A graphics library for quick creation of PNG or JPEG images Description : The gd graphics library allows your code to quickly draw images complete with lines, arcs, text, multiple colors, cut and paste from other images, and flood fills, and to write out the result as a PNG or JPEG file. This is particularly useful in Web applications, where PNG and JPEG are two of the formats accepted for inline images by most browsers. Note that gd is not a paint program. -------------------------------------------------------------------------------- Update Information: - Security fix for CVE-2016-8670 - Security fix for CVE-2016-6911 - Security fix for CVE-2016-7568 - For Fedora 26 disabled two tests - they are failing because of freetype 2.7 (https://github.com/libgd/libgd/issues/302, https://github.com/libgd/libgd/issues/217) -------------------------------------------------------------------------------- References: [ 1 ] Bug #1380450 - CVE-2016-7568 gd, php: Integer overflow in gdImageWebpCtx https://bugzilla.redhat.com/show_bug.cgi?id=1380450 [ 2 ] Bug #1388787 - CVE-2016-6911 gd, php: Missing check for OOB read in dynamicGetbuf() https://bugzilla.redhat.com/show_bug.cgi?id=1388787 [ 3 ] Bug #1391068 - CVE-2016-8670 gd, php: Stack based buffer overflow in dynamicGetbuf https://bugzilla.redhat.com/show_bug.cgi?id=1391068 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade gd' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Dec 16, 2016
•Critical
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!