Detections
Analytics
Mandrake Linux Security Advisory : gd (MDKSA-2007:153)
medium Nessus Plugin ID 25875
Synopsis
The remote Mandrake Linux host is missing one or more security updates.Description
GD versions prior to 2.0.35 have a number of bugs which potentially lead to denial of service and possibly other issues.Integer overflow in gdImageCreateTrueColor function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to have unspecified remote attack vectors and impact. (CVE-2007-3472)
The gdImageCreateXbm function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors involving a gdImageCreate failure. (CVE-2007-3473)
Multiple unspecified vulnerabilities in the GIF reader in the GD Graphics Library (libgd) before 2.0.35 allow user-assisted remote attackers to have unspecified attack vectors and impact.
(CVE-2007-3474)
The GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via a GIF image that has no global color map. (CVE-2007-3475)
Array index error in gd_gif_in.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash and heap corruption) via large color index values in crafted image data, which results in a segmentation fault.
(CVE-2007-3476)
The (a) imagearc and (b) imagefilledarc functions in GD Graphics Library (libgd) before 2.0.35 allows attackers to cause a denial of service (CPU consumption) via a large (1) start or (2) end angle degree value. (CVE-2007-3477)
Race condition in gdImageStringFTEx (gdft_draw_bitmap) in gdft.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors, possibly involving truetype font (TTF) support.
(CVE-2007-3478)
The security issues related to GIF image handling (CVE-2007-3473, CVE-2007-3474, CVE-2007-3475, CVE-2007-3476) do not affect Corporate 3.0, as the version of GD included in these versions does not include GIF support.
Updated packages have been patched to prevent these issues.
Solution
Update the affected packages.Plugin Details
Severity: Medium
ID: 25875
File Name: mandrake_MDKSA-2007-153.nasl
Version: 1.19
Type: local
Family: Mandriva Local Security Checks
Published: 8/13/2007
Updated: 1/6/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.4
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.9
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P
Vulnerability Information
CPE: p-cpe:/a:mandriva:linux:gd-utils, p-cpe:/a:mandriva:linux:lib64gd2, p-cpe:/a:mandriva:linux:lib64gd2-devel, p-cpe:/a:mandriva:linux:lib64gd2-static-devel, p-cpe:/a:mandriva:linux:libgd2, p-cpe:/a:mandriva:linux:libgd2-devel, p-cpe:/a:mandriva:linux:libgd2-static-devel, cpe:/o:mandriva:linux:2007, cpe:/o:mandriva:linux:2007.1
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 8/3/2007
Reference Information
CVE: CVE-2007-3472, CVE-2007-3473, CVE-2007-3474, CVE-2007-3475, CVE-2007-3476, CVE-2007-3477, CVE-2007-3478
BID: 24651