Integer overflow in gdImageCreateTrueColor function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to have unspecified attack vectors and impact.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - gd: additional overflows (CVE-2004-0941)

  - libwmf: Memory allocation failure in wmf_malloc (CVE-2016-9011)

  - Buffer overflow in the gdImageStringFTEx function in gdft.c in GD Graphics Library 2.0.33 and earlier     allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary     code via a crafted string with a JIS encoded font. (CVE-2007-0455)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - gd: additional overflows (CVE-2004-0941)

  - libwmf: Memory allocation failure in wmf_malloc (CVE-2016-9011)

  - Buffer overflow in the gdImageStringFTEx function in gdft.c in GD Graphics Library 2.0.33 and earlier     allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary     code via a crafted string with a JIS encoded font. (CVE-2007-0455)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - gd: additional overflows (CVE-2004-0941)

  - gd: arc drawing functions can consume large amount of CPU time (CVE-2007-3477)

  - Buffer overflow in the gdImageStringFTEx function in gdft.c in GD Graphics Library 2.0.33 and earlier     allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary     code via a crafted string with a JIS encoded font. (CVE-2007-0455)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

New libwmf packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix security issues.

It was discovered that libwmf did not correctly process certain WMF (Windows Metafiles) with embedded BMP images. By tricking a victim into opening a specially crafted WMF file in an application using libwmf, a remote attacker could possibly use this flaw to execute arbitrary code with the privileges of the user running the application. (CVE-2015-0848 , CVE-2015-4588)

It was discovered that libwmf did not properly process certain WMF files. By tricking a victim into opening a specially crafted WMF file in an application using libwmf, a remote attacker could possibly exploit this flaw to cause a crash or execute arbitrary code with the privileges of the user running the application. (CVE-2015-4696)

It was discovered that libwmf did not properly process certain WMF files. By tricking a victim into opening a specially crafted WMF file in an application using libwmf, a remote attacker could possibly exploit this flaw to cause a crash. (CVE-2015-4695)

The gdPngReadData function in libgd 2.0.34 allows user-assisted attackers to cause a denial of service (CPU consumption) via a crafted PNG image with truncated data, which causes an infinite loop in the png_read_info function in libpng. (CVE-2007-2756)

Buffer overflow in the gdImageStringFTEx function in gdft.c in GD Graphics Library 2.0.33 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted string with a JIS encoded font. (CVE-2007-0455)

The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.x before 5.3.1, and the GD Graphics Library 2.x, does not properly verify a certain colorsTotal structure member, which might allow remote attackers to conduct buffer overflow or buffer over-read attacks via a crafted GD file, a different vulnerability than CVE-2009-3293 . NOTE:
some of these details are obtained from third party information.
(CVE-2009-3546)

Integer overflow in gdImageCreateTrueColor function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to have unspecified attack vectors and impact. (CVE-2007-3472)

The gdImageCreateXbm function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors involving a gdImageCreate failure. (CVE-2007-3473)

Mitre reports :

Multiple buffer overflows in the gd graphics library (libgd) 2.0.21 and earlier may allow remote attackers to execute arbitrary code via malformed image files that trigger the overflows due to improper calls to the gdMalloc function, a different set of vulnerabilities than CVE-2004-0990.

Buffer overflow in the gdImageStringFTEx function in gdft.c in GD Graphics Library 2.0.33 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted string with a JIS encoded font.

The gdPngReadData function in libgd 2.0.34 allows user-assisted attackers to cause a denial of service (CPU consumption) via a crafted PNG image with truncated data, which causes an infinite loop in the png_read_info function in libpng.

Integer overflow in gdImageCreateTrueColor function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to have unspecified attack vectors and impact.

The gdImageCreateXbm function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors involving a gdImageCreate failure.

The (a) imagearc and (b) imagefilledarc functions in GD Graphics Library (libgd) before 2.0.35 allow attackers to cause a denial of service (CPU consumption) via a large (1) start or (2) end angle degree value.

The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.x before 5.3.1, and the GD Graphics Library 2.x, does not properly verify a certain colorsTotal structure member, which might allow remote attackers to conduct buffer overflow or buffer over-read attacks via a crafted GD file, a different vulnerability than CVE-2009-3293. NOTE:
some of these details are obtained from third party information.

Heap-based buffer overflow in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image.

meta.h in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WMF file.

Use-after-free vulnerability in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) via a crafted WMF file to the (1) wmf2gd or (2) wmf2eps command.

Heap-based buffer overflow in the DecodeImage function in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted 'run-length count' in an image in a WMF file.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2008-0146 advisory.

    [2.0.28-5.E4.1]
     - security fixes
     - Resolves: #432784

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple issues were discovered in the gd GIF image-handling code. A carefully-crafted GIF file could cause a crash or possibly execute code with the privileges of the application using the gd library.
(CVE-2006-4484, CVE-2007-3475, CVE-2007-3476)

An integer overflow was discovered in the gdImageCreateTrueColor() function, leading to incorrect memory allocations. A carefully crafted image could cause a crash or possibly execute code with the privileges of the application using the gd library. (CVE-2007-3472)

A buffer over-read flaw was discovered. This could cause a crash in an application using the gd library to render certain strings using a JIS-encoded font. (CVE-2007-0455)

A flaw was discovered in the gd PNG image handling code. A truncated PNG image could cause an infinite loop in an application using the gd library. (CVE-2007-2756)

A flaw was discovered in the gd X BitMap (XBM) image-handling code. A malformed or truncated XBM image could cause a crash in an application using the gd library. (CVE-2007-3473)

- Mon Dec 6 2010 Caolan McNamara <caolanm at redhat.com> -     0.2.8.4-27

    - Resolves: rhbz#660161 security issues

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Mon Dec 6 2010 Caolan McNamara <caolanm at redhat.com> -     0.2.8.4-22

    - Resolves: rhbz#660161 security issues

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes multiple bugs in PHP :

  - Predictable generaton of an initialization vector (IV)     in the mcrypt extension

  - Additional cookie attributes could be injected via a     session ID.

  - Specially crafted files could cause integer overflows in     gd and leverage them to at least crash gd based     applications.

This update covers CVE IDs CVE-2007-2727, CVE-2007-3472, CVE-2007-3475, CVE-2007-3476 CVE-2007-3477, CVE-2007-3478 and CVE-2007-3799.

This update fixes multiple integer overflows in the gd library.
Specially crafted files could leverage them to at least crash gd based applications. (CVE-2007-3472, CVE-2007-3475, CVE-2007-3476, CVE-2007-3477, CVE-2007-3478)

Updated gd packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The gd package contains a graphics library used for the dynamic creation of images such as PNG and JPEG.

Multiple issues were discovered in the gd GIF image-handling code. A carefully-crafted GIF file could cause a crash or possibly execute code with the privileges of the application using the gd library.
(CVE-2006-4484, CVE-2007-3475, CVE-2007-3476)

An integer overflow was discovered in the gdImageCreateTrueColor() function, leading to incorrect memory allocations. A carefully crafted image could cause a crash or possibly execute code with the privileges of the application using the gd library. (CVE-2007-3472)

A buffer over-read flaw was discovered. This could cause a crash in an application using the gd library to render certain strings using a JIS-encoded font. (CVE-2007-0455)

A flaw was discovered in the gd PNG image handling code. A truncated PNG image could cause an infinite loop in an application using the gd library. (CVE-2007-2756)

A flaw was discovered in the gd X BitMap (XBM) image-handling code. A malformed or truncated XBM image could cause a crash in an application using the gd library. (CVE-2007-3473)

Users of gd should upgrade to these updated packages, which contain backported patches which resolve these issues.

This update fixes multiple integer overflows in the gd library.
Specially crafted files could leverage them to at least crash gd based applications. (CVE-2007-3472 / CVE-2007-3475 / CVE-2007-3476 / CVE-2007-3477 / CVE-2007-3478)

This update fixes multiple bugs in php :

  - predictable generaton of an initialization vector (IV)     in the mcrypt extension

  - additional cookie attributes could be injected via a     session id

  - specially crafted files could cause integer overflows in     gd and leverage them to at least crash gd based     applications

  - insufficient validation of parmeters in the substr_count     function

  - predictable generaton of an initialization vector (IV)     in the soap extension

CVE-2007-2727 / CVE-2007-2748 / CVE-2007-2728 / CVE-2007-3472 / CVE-2007-3475 / CVE-2007-3476 / CVE-2007-3477 / CVE-2007-3478 / CVE-2007-3799

- Wed Sep 5 2007 Ivana varekova <varekova at redhat.com>     2.0.35-1

    - update to 2.0.35

    - fix several vulnerabilities #277421

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes multiple integer overflows in the gd library.
Specially crafted files could leverage them to at least crash gd based applications (CVE-2007-3472, CVE-2007-3475, CVE-2007-3476, CVE-2007-3477, CVE-2007-3478).

This update fixes multiple bugs in php :

  - predictable generaton of an initialization vector (IV)     in the mcrypt extension

  - additional cookie attributes could be injected via a     session id

  - specially crafted files could cause integer overflows in     gd and leverage them to at least crash gd based     applications

  - insufficient validation of parmeters in the substr_count     function

  - predictable generaton of an initialization vector (IV)     in the soap extension

CVE-2007-2727, CVE-2007-2748, CVE-2007-2728, CVE-2007-3472 CVE-2007-3475, CVE-2007-3476, CVE-2007-3477, CVE-2007-3478 CVE-2007-3799

- Wed Sep 5 2007 Ivana Varekova <varekova at redhat.com> -     2.0.35-1

    - update to 2.0.35

    - fix several vulnerabilities #277421

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Maurycy Prodeus found an integer overflow vulnerability in the way various PDF viewers processed PDF files. An attacker could create a malicious PDF file that could cause tetex to crash and possibly execute arbitrary code open a user opening the file.

In addition, tetex contains an embedded copy of the GD library which suffers from a number of bugs which potentially lead to denial of service and possibly other issues.

Integer overflow in gdImageCreateTrueColor function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to have unspecified remote attack vectors and impact. (CVE-2007-3472)

The gdImageCreateXbm function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors involving a gdImageCreate failure. (CVE-2007-3473)

Multiple unspecified vulnerabilities in the GIF reader in the GD Graphics Library (libgd) before 2.0.35 allow user-assisted remote attackers to have unspecified attack vectors and impact.
(CVE-2007-3474)

The GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via a GIF image that has no global color map. (CVE-2007-3475)

Array index error in gd_gif_in.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash and heap corruption) via large color index values in crafted image data, which results in a segmentation fault.
(CVE-2007-3476)

The (a) imagearc and (b) imagefilledarc functions in GD Graphics Library (libgd) before 2.0.35 allows attackers to cause a denial of service (CPU consumption) via a large (1) start or (2) end angle degree value. (CVE-2007-3477)

Race condition in gdImageStringFTEx (gdft_draw_bitmap) in gdft.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors, possibly involving truetype font (TTF) support.
(CVE-2007-3478)

Updated packages have been patched to prevent these issues.

GD versions prior to 2.0.35 have a number of bugs which potentially lead to denial of service and possibly other issues.

Integer overflow in gdImageCreateTrueColor function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to have unspecified remote attack vectors and impact. (CVE-2007-3472)

The gdImageCreateXbm function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors involving a gdImageCreate failure. (CVE-2007-3473)

Multiple unspecified vulnerabilities in the GIF reader in the GD Graphics Library (libgd) before 2.0.35 allow user-assisted remote attackers to have unspecified attack vectors and impact.
(CVE-2007-3474)

The GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via a GIF image that has no global color map. (CVE-2007-3475)

Array index error in gd_gif_in.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash and heap corruption) via large color index values in crafted image data, which results in a segmentation fault.
(CVE-2007-3476)

The (a) imagearc and (b) imagefilledarc functions in GD Graphics Library (libgd) before 2.0.35 allows attackers to cause a denial of service (CPU consumption) via a large (1) start or (2) end angle degree value. (CVE-2007-3477)

Race condition in gdImageStringFTEx (gdft_draw_bitmap) in gdft.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors, possibly involving truetype font (TTF) support.
(CVE-2007-3478)

The security issues related to GIF image handling (CVE-2007-3473, CVE-2007-3474, CVE-2007-3475, CVE-2007-3476) do not affect Corporate 3.0, as the version of GD included in these versions does not include GIF support.

Updated packages have been patched to prevent these issues.

The remote host is affected by the vulnerability described in GLSA-200708-05 (GD: Multiple vulnerabilities)

    Xavier Roche discovered an infinite loop in the gdPngReadData()     function when processing a truncated PNG file (CVE-2007-2756). An     integer overflow has been discovered in the gdImageCreateTrueColor()     function (CVE-2007-3472). An error has been discovered in the function     gdImageCreateXbm() function (CVE-2007-3473). Unspecified     vulnerabilities have been discovered in the GIF reader (CVE-2007-3474).
    An error has been discovered when processing a GIF image that has no     global color map (CVE-2007-3475). An array index error has been     discovered in the file gd_gif_in.c when processing images with an     invalid color index (CVE-2007-3476). An error has been discovered in     the imagearc() and imagefilledarc() functions when processing overly     large angle values (CVE-2007-3477). A race condition has been     discovered in the gdImageStringFTEx() function (CVE-2007-3478).
  Impact :

    A remote attacker could exploit one of these vulnerabilities to cause a     Denial of Service or possibly execute arbitrary code with the     privileges of the user running GD.
  Workaround :

    There is no known workaround at this time.

gd had been reported vulnerable to several vulnerabilities :

- CVE-2007-3472: Integer overflow in gdImageCreateTrueColor function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers has unspecified attack vectors and impact.

- CVE-2007-3473: The gdImageCreateXbm function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors involving a gdImageCreate failure.

- CVE-2007-3474: Multiple unspecified vulnerabilities in the GIF reader in the GD Graphics Library (libgd) before 2.0.35 allow user-assisted remote attackers to have unspecified attack vectors and impact.

- CVE-2007-3475: The GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via a GIF image that has no global color map.

- CVE-2007-3476: Array index error in gd_gif_in.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash and heap corruption) via large color index values in crafted image data, which results in a segmentation fault.

- CVE-2007-3477: The (a) imagearc and (b) imagefilledarc functions in GD Graphics Library (libgd) before 2.0.35 allows attackers to cause a denial of service (CPU consumption) via a large (1) start or (2) end angle degree value.

- CVE-2007-3478: Race condition in gdImageStringFTEx (gdft_draw_bitmap) in gdft.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors, possibly involving truetype font (TTF) support.

ID	Name	Product	Family	Severity
198402	RHEL 5 : libwmf (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
198368	RHEL 6 : libwmf (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
198345	RHEL 4 : libwmf (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
109432	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : libwmf (SSA:2018-120-01)	Nessus	Slackware Local Security Checks	high
86635	Amazon Linux AMI : libwmf (ALAS-2015-604)	Nessus	Amazon Linux Local Security Checks	high
84782	FreeBSD : libwmf -- multiple vulnerabilities (ca139c7f-2a8c-11e5-a4a5-002590263bf5)	Nessus	FreeBSD Local Security Checks	critical
67657	Oracle Linux 5 : Moderate: / gd (ELSA-2008-0146)	Nessus	Oracle Linux Local Security Checks	high
60367	Scientific Linux Security Update : gd on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
51415	Fedora 14 : libwmf-0.2.8.4-27.fc14 (2010-19033)	Nessus	Fedora Local Security Checks	high
51414	Fedora 13 : libwmf-0.2.8.4-22.fc13 (2010-19022)	Nessus	Fedora Local Security Checks	high
41143	SuSE9 Security Update : PHP4 (YOU Patch Number 11666)	Nessus	SuSE Local Security Checks	medium
41138	SuSE9 Security Update : gd (YOU Patch Number 11578)	Nessus	SuSE Local Security Checks	medium
31310	CentOS 4 / 5 : gd (CESA-2008:0146)	Nessus	CentOS Local Security Checks	high
31306	RHEL 4 / 5 : gd (RHSA-2008:0146)	Nessus	Red Hat Local Security Checks	high
29440	SuSE 10 Security Update : gd (ZYPP Patch Number 3895)	Nessus	SuSE Local Security Checks	medium
29379	SuSE 10 Security Update : PHP5 (ZYPP Patch Number 3980)	Nessus	SuSE Local Security Checks	medium
27748	Fedora 7 : gd-2.0.35-1.fc7 (2007-2055)	Nessus	Fedora Local Security Checks	medium
27231	openSUSE 10 Security Update : gd (gd-3896)	Nessus	SuSE Local Security Checks	medium
27152	openSUSE 10 Security Update : apache2-mod_php5 (apache2-mod_php5-3979)	Nessus	SuSE Local Security Checks	medium
27151	openSUSE 10 Security Update : apache2-mod_php5 (apache2-mod_php5-3978)	Nessus	SuSE Local Security Checks	medium
26081	Fedora Core 6 : gd-2.0.35-1.fc6 (2007-692)	Nessus	Fedora Local Security Checks	medium
25896	Mandrake Linux Security Advisory : tetex (MDKSA-2007:164)	Nessus	Mandriva Local Security Checks	medium
25875	Mandrake Linux Security Advisory : gd (MDKSA-2007:153)	Nessus	Mandriva Local Security Checks	medium
25870	GLSA-200708-05 : GD: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
25633	FreeBSD : gd -- multiple vulnerabilities (6e099997-25d8-11dc-878b-000c29c5647f)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2007-3472

critical

Tenable Plugins

medium

medium

high

high

high

critical

high

high

high

high

medium

medium

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium