ECHO-0435-D140-FC4A Buffer overflow/over-read in _gdGetColors (gd_gd.c) reached via the GD-file reader (gdImageCreateFromGd) when colorsTotal is not validated (libgd 2.x / PHP before 5.3.1). libwmf uses its bundled GD only as an output backend and exposes no API that decodes an untrusted .gd file, so the vulnerable reader path is never invoked. Additionally the upstream validation is already present in this trixie source: _gdGetColors in src/extra/gd/gd_gd.c rejects colorsTotal > gdMaxColors, and the non-2x branch reads colorsTotal as a single byte (<= 255 < gdMaxColors). Not reachable and already remediated in source; scanners flag it only via Debian's stale source-package match (trixie "unimportant / unfixed"; standalone libgd2 is fixed).
| Reporter | Title | Published | Views | Family All 147 |
|---|---|---|---|---|
 | gd -- '_gdGetColors' remote buffer overflow vulnerability | 15 Oct 200900:00 | – | freebsd |
| libwmf -- multiple vulnerabilities | 12 Oct 200400:00 | – | freebsd |
 | Important: libwmf | 27 Oct 201500:00 | – | amazon |
 | Amazon Linux AMI : libwmf (ALAS-2015-604) | 29 Oct 201500:00 | – | nessus |
| CentOS 4 / 5 : gd (CESA-2010:0003) | 5 Jan 201000:00 | – | nessus |
| CentOS 3 / 4 / 5 : php (CESA-2010:0040) | 14 Jan 201000:00 | – | nessus |
| Debian DSA-1936-1 : libgd2 - several vulnerabilities | 24 Feb 201000:00 | – | nessus |
| Fedora 12 : maniadrive-1.2-19.fc12 / php-5.3.1-1.fc12 (2009-12017) | 7 Dec 200900:00 | – | nessus |
| Fedora 11 : maniadrive-1.2-17.fc11 / php-5.2.12-1.fc11 (2010-0495) | 1 Jul 201000:00 | – | nessus |
| Fedora 17 : gd-2.0.35-17.fc17 (2012-9298) | 1 Jul 201200:00 | – | nessus |
10
| Source | Link |
|---|---|
| advisory | www.advisory.echohq.com/cve/CVE-2009-3546 |
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
15 Sep 2026 03:33Current
6.6Medium risk
Vulners AI Score6.6
CVSS 29.3
EPSS0.10247