Race condition in gdImageStringFTEx (gdft_draw_bitmap) in gdft.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors, possibly involving truetype font (TTF) support.

- Mon Dec 6 2010 Caolan McNamara <caolanm at redhat.com> -     0.2.8.4-27

    - Resolves: rhbz#660161 security issues

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Mon Dec 6 2010 Caolan McNamara <caolanm at redhat.com> -     0.2.8.4-22

    - Resolves: rhbz#660161 security issues

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes multiple bugs in PHP :

  - Predictable generaton of an initialization vector (IV)     in the mcrypt extension

  - Additional cookie attributes could be injected via a     session ID.

  - Specially crafted files could cause integer overflows in     gd and leverage them to at least crash gd based     applications.

This update covers CVE IDs CVE-2007-2727, CVE-2007-3472, CVE-2007-3475, CVE-2007-3476 CVE-2007-3477, CVE-2007-3478 and CVE-2007-3799.

This update fixes multiple integer overflows in the gd library.
Specially crafted files could leverage them to at least crash gd based applications. (CVE-2007-3472, CVE-2007-3475, CVE-2007-3476, CVE-2007-3477, CVE-2007-3478)

This update fixes multiple integer overflows in the gd library.
Specially crafted files could leverage them to at least crash gd based applications. (CVE-2007-3472 / CVE-2007-3475 / CVE-2007-3476 / CVE-2007-3477 / CVE-2007-3478)

This update fixes multiple bugs in php :

  - predictable generaton of an initialization vector (IV)     in the mcrypt extension

  - additional cookie attributes could be injected via a     session id

  - specially crafted files could cause integer overflows in     gd and leverage them to at least crash gd based     applications

  - insufficient validation of parmeters in the substr_count     function

  - predictable generaton of an initialization vector (IV)     in the soap extension

CVE-2007-2727 / CVE-2007-2748 / CVE-2007-2728 / CVE-2007-3472 / CVE-2007-3475 / CVE-2007-3476 / CVE-2007-3477 / CVE-2007-3478 / CVE-2007-3799

- Wed Sep 5 2007 Ivana varekova <varekova at redhat.com>     2.0.35-1

    - update to 2.0.35

    - fix several vulnerabilities #277421

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes multiple integer overflows in the gd library.
Specially crafted files could leverage them to at least crash gd based applications (CVE-2007-3472, CVE-2007-3475, CVE-2007-3476, CVE-2007-3477, CVE-2007-3478).

This update fixes multiple bugs in php :

  - predictable generaton of an initialization vector (IV)     in the mcrypt extension

  - additional cookie attributes could be injected via a     session id

  - specially crafted files could cause integer overflows in     gd and leverage them to at least crash gd based     applications

  - insufficient validation of parmeters in the substr_count     function

  - predictable generaton of an initialization vector (IV)     in the soap extension

CVE-2007-2727, CVE-2007-2748, CVE-2007-2728, CVE-2007-3472 CVE-2007-3475, CVE-2007-3476, CVE-2007-3477, CVE-2007-3478 CVE-2007-3799

- Wed Sep 5 2007 Ivana Varekova <varekova at redhat.com> -     2.0.35-1

    - update to 2.0.35

    - fix several vulnerabilities #277421

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Maurycy Prodeus found an integer overflow vulnerability in the way various PDF viewers processed PDF files. An attacker could create a malicious PDF file that could cause tetex to crash and possibly execute arbitrary code open a user opening the file.

In addition, tetex contains an embedded copy of the GD library which suffers from a number of bugs which potentially lead to denial of service and possibly other issues.

Integer overflow in gdImageCreateTrueColor function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to have unspecified remote attack vectors and impact. (CVE-2007-3472)

The gdImageCreateXbm function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors involving a gdImageCreate failure. (CVE-2007-3473)

Multiple unspecified vulnerabilities in the GIF reader in the GD Graphics Library (libgd) before 2.0.35 allow user-assisted remote attackers to have unspecified attack vectors and impact.
(CVE-2007-3474)

The GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via a GIF image that has no global color map. (CVE-2007-3475)

Array index error in gd_gif_in.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash and heap corruption) via large color index values in crafted image data, which results in a segmentation fault.
(CVE-2007-3476)

The (a) imagearc and (b) imagefilledarc functions in GD Graphics Library (libgd) before 2.0.35 allows attackers to cause a denial of service (CPU consumption) via a large (1) start or (2) end angle degree value. (CVE-2007-3477)

Race condition in gdImageStringFTEx (gdft_draw_bitmap) in gdft.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors, possibly involving truetype font (TTF) support.
(CVE-2007-3478)

Updated packages have been patched to prevent these issues.

GD versions prior to 2.0.35 have a number of bugs which potentially lead to denial of service and possibly other issues.

Integer overflow in gdImageCreateTrueColor function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to have unspecified remote attack vectors and impact. (CVE-2007-3472)

The gdImageCreateXbm function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors involving a gdImageCreate failure. (CVE-2007-3473)

Multiple unspecified vulnerabilities in the GIF reader in the GD Graphics Library (libgd) before 2.0.35 allow user-assisted remote attackers to have unspecified attack vectors and impact.
(CVE-2007-3474)

The GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via a GIF image that has no global color map. (CVE-2007-3475)

Array index error in gd_gif_in.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash and heap corruption) via large color index values in crafted image data, which results in a segmentation fault.
(CVE-2007-3476)

The (a) imagearc and (b) imagefilledarc functions in GD Graphics Library (libgd) before 2.0.35 allows attackers to cause a denial of service (CPU consumption) via a large (1) start or (2) end angle degree value. (CVE-2007-3477)

Race condition in gdImageStringFTEx (gdft_draw_bitmap) in gdft.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors, possibly involving truetype font (TTF) support.
(CVE-2007-3478)

The security issues related to GIF image handling (CVE-2007-3473, CVE-2007-3474, CVE-2007-3475, CVE-2007-3476) do not affect Corporate 3.0, as the version of GD included in these versions does not include GIF support.

Updated packages have been patched to prevent these issues.

The remote host is affected by the vulnerability described in GLSA-200708-05 (GD: Multiple vulnerabilities)

    Xavier Roche discovered an infinite loop in the gdPngReadData()     function when processing a truncated PNG file (CVE-2007-2756). An     integer overflow has been discovered in the gdImageCreateTrueColor()     function (CVE-2007-3472). An error has been discovered in the function     gdImageCreateXbm() function (CVE-2007-3473). Unspecified     vulnerabilities have been discovered in the GIF reader (CVE-2007-3474).
    An error has been discovered when processing a GIF image that has no     global color map (CVE-2007-3475). An array index error has been     discovered in the file gd_gif_in.c when processing images with an     invalid color index (CVE-2007-3476). An error has been discovered in     the imagearc() and imagefilledarc() functions when processing overly     large angle values (CVE-2007-3477). A race condition has been     discovered in the gdImageStringFTEx() function (CVE-2007-3478).
  Impact :

    A remote attacker could exploit one of these vulnerabilities to cause a     Denial of Service or possibly execute arbitrary code with the     privileges of the user running GD.
  Workaround :

    There is no known workaround at this time.

gd had been reported vulnerable to several vulnerabilities :

- CVE-2007-3472: Integer overflow in gdImageCreateTrueColor function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers has unspecified attack vectors and impact.

- CVE-2007-3473: The gdImageCreateXbm function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors involving a gdImageCreate failure.

- CVE-2007-3474: Multiple unspecified vulnerabilities in the GIF reader in the GD Graphics Library (libgd) before 2.0.35 allow user-assisted remote attackers to have unspecified attack vectors and impact.

- CVE-2007-3475: The GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via a GIF image that has no global color map.

- CVE-2007-3476: Array index error in gd_gif_in.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash and heap corruption) via large color index values in crafted image data, which results in a segmentation fault.

- CVE-2007-3477: The (a) imagearc and (b) imagefilledarc functions in GD Graphics Library (libgd) before 2.0.35 allows attackers to cause a denial of service (CPU consumption) via a large (1) start or (2) end angle degree value.

- CVE-2007-3478: Race condition in gdImageStringFTEx (gdft_draw_bitmap) in gdft.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors, possibly involving truetype font (TTF) support.

ID	Name	Product	Family	Severity
51415	Fedora 14 : libwmf-0.2.8.4-27.fc14 (2010-19033)	Nessus	Fedora Local Security Checks	high
51414	Fedora 13 : libwmf-0.2.8.4-22.fc13 (2010-19022)	Nessus	Fedora Local Security Checks	high
41143	SuSE9 Security Update : PHP4 (YOU Patch Number 11666)	Nessus	SuSE Local Security Checks	medium
41138	SuSE9 Security Update : gd (YOU Patch Number 11578)	Nessus	SuSE Local Security Checks	medium
29440	SuSE 10 Security Update : gd (ZYPP Patch Number 3895)	Nessus	SuSE Local Security Checks	medium
29379	SuSE 10 Security Update : PHP5 (ZYPP Patch Number 3980)	Nessus	SuSE Local Security Checks	medium
27748	Fedora 7 : gd-2.0.35-1.fc7 (2007-2055)	Nessus	Fedora Local Security Checks	medium
27231	openSUSE 10 Security Update : gd (gd-3896)	Nessus	SuSE Local Security Checks	medium
27152	openSUSE 10 Security Update : apache2-mod_php5 (apache2-mod_php5-3979)	Nessus	SuSE Local Security Checks	medium
27151	openSUSE 10 Security Update : apache2-mod_php5 (apache2-mod_php5-3978)	Nessus	SuSE Local Security Checks	medium
26081	Fedora Core 6 : gd-2.0.35-1.fc6 (2007-692)	Nessus	Fedora Local Security Checks	medium
25896	Mandrake Linux Security Advisory : tetex (MDKSA-2007:164)	Nessus	Mandriva Local Security Checks	medium
25875	Mandrake Linux Security Advisory : gd (MDKSA-2007:153)	Nessus	Mandriva Local Security Checks	medium
25870	GLSA-200708-05 : GD: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
25633	FreeBSD : gd -- multiple vulnerabilities (6e099997-25d8-11dc-878b-000c29c5647f)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2007-3478

medium

Tenable Plugins

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium