Lucene search
Symantec Security ResponseSMNTC-106731HistoryJan 26, 2019 - 12:00 a.m.
LibGD CVE-2019-6977 Heap Buffer Overflow Vulnerability
2019-01-2600:00:00
Symantec Security Response
www.symantec.com
270
Description
LibGD is prone to a heap-based buffer-overflow vulnerability. An attacker can exploit these issues to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely result in denial-of-service conditions. LibGD 2.2.5 is vulnerable; other versions may also be affected.
Technologies Affected
- IBM Flex System Chassis Management Module (CMM) 2PET
- LibGD LibGD 2.2.5
- PHP PHP 2.0
- PHP PHP 3.0.0 .10
- PHP PHP 3.0.0 .11
- PHP PHP 3.0.0 .12
- PHP PHP 3.0.0 .13
- PHP PHP 3.0.0 .16
- PHP PHP 3.0.0 0
- PHP PHP 3.0.1
- PHP PHP 3.0.10
- PHP PHP 3.0.11
- PHP PHP 3.0.12
- PHP PHP 3.0.13
- PHP PHP 3.0.14
- PHP PHP 3.0.15
- PHP PHP 3.0.16
- PHP PHP 3.0.17
- PHP PHP 3.0.18
- PHP PHP 3.0.2
- PHP PHP 3.0.3
- PHP PHP 3.0.4
- PHP PHP 3.0.5
- PHP PHP 3.0.6
- PHP PHP 3.0.7
- PHP PHP 3.0.8
- PHP PHP 3.0.9
- PHP PHP 4
- PHP PHP 4.0.0 0
- PHP PHP 4.0.1
- PHP PHP 4.0.2
- PHP PHP 4.0.3
- PHP PHP 4.0.4
- PHP PHP 4.0.5
- PHP PHP 4.0.6
- PHP PHP 4.0.7
- PHP PHP 4.1.0 .0
- PHP PHP 4.1.1
- PHP PHP 4.1.2
- PHP PHP 4.1.3
- PHP PHP 4.2.1
- PHP PHP 4.2.2
- PHP PHP 4.2.3
- PHP PHP 4.2.4
- PHP PHP 4.3.0
- PHP PHP 4.3.1
- PHP PHP 4.3.10
- PHP PHP 4.3.11
- PHP PHP 4.3.2
- PHP PHP 4.3.3
- PHP PHP 4.3.4
- PHP PHP 4.3.5
- PHP PHP 4.3.6
- PHP PHP 4.3.7
- PHP PHP 4.3.8
- PHP PHP 4.3.9
- PHP PHP 4.4.0 .0
- PHP PHP 4.4.1
- PHP PHP 4.4.2
- PHP PHP 4.4.3
- PHP PHP 4.4.4
- PHP PHP 4.4.5
- PHP PHP 4.4.6
- PHP PHP 4.4.7
- PHP PHP 4.4.8
- PHP PHP 4.4.9
- PHP PHP 4.5
- PHP PHP 5
- PHP PHP 5.0
- PHP PHP 5.0.1
- PHP PHP 5.0.2
- PHP PHP 5.0.3
- PHP PHP 5.0.4
- PHP PHP 5.0.5
- PHP PHP 5.1.0
- PHP PHP 5.1.1
- PHP PHP 5.1.2
- PHP PHP 5.1.3
- PHP PHP 5.1.4
- PHP PHP 5.1.43
- PHP PHP 5.1.5
- PHP PHP 5.1.6
- PHP PHP 5.2
- PHP PHP 5.2.1
- PHP PHP 5.2.10
- PHP PHP 5.2.11
- PHP PHP 5.2.12
- PHP PHP 5.2.13
- PHP PHP 5.2.14
- PHP PHP 5.2.15
- PHP PHP 5.2.16
- PHP PHP 5.2.17
- PHP PHP 5.2.2
- PHP PHP 5.2.3
- PHP PHP 5.2.4
- PHP PHP 5.2.5
- PHP PHP 5.2.6
- PHP PHP 5.2.7
- PHP PHP 5.2.8
- PHP PHP 5.2.9
- PHP PHP 5.3.0
- PHP PHP 5.3.1
- PHP PHP 5.3.10
- PHP PHP 5.3.11
- PHP PHP 5.3.12
- PHP PHP 5.3.13
- PHP PHP 5.3.14
- PHP PHP 5.3.15
- PHP PHP 5.3.16
- PHP PHP 5.3.17
- PHP PHP 5.3.18
- PHP PHP 5.3.19
- PHP PHP 5.3.2
- PHP PHP 5.3.20
- PHP PHP 5.3.21
- PHP PHP 5.3.22
- PHP PHP 5.3.23
- PHP PHP 5.3.24
- PHP PHP 5.3.25
- PHP PHP 5.3.26
- PHP PHP 5.3.27
- PHP PHP 5.3.28
- PHP PHP 5.3.29
- PHP PHP 5.3.3
- PHP PHP 5.3.4
- PHP PHP 5.3.5
- PHP PHP 5.3.6
- PHP PHP 5.3.7
- PHP PHP 5.3.8
- PHP PHP 5.3.9
- PHP PHP 5.4.0
- PHP PHP 5.4.1
- PHP PHP 5.4.10
- PHP PHP 5.4.11
- PHP PHP 5.4.12
- PHP PHP 5.4.13
- PHP PHP 5.4.14
- PHP PHP 5.4.15
- PHP PHP 5.4.16
- PHP PHP 5.4.17
- PHP PHP 5.4.18
- PHP PHP 5.4.19
- PHP PHP 5.4.2
- PHP PHP 5.4.20
- PHP PHP 5.4.21
- PHP PHP 5.4.22
- PHP PHP 5.4.23
- PHP PHP 5.4.24
- PHP PHP 5.4.25
- PHP PHP 5.4.26
- PHP PHP 5.4.27
- PHP PHP 5.4.28
- PHP PHP 5.4.29
- PHP PHP 5.4.3
- PHP PHP 5.4.30
- PHP PHP 5.4.31
- PHP PHP 5.4.32
- PHP PHP 5.4.33
- PHP PHP 5.4.34
- PHP PHP 5.4.35
- PHP PHP 5.4.36
- PHP PHP 5.4.37
- PHP PHP 5.4.38
- PHP PHP 5.4.39
- PHP PHP 5.4.4
- PHP PHP 5.4.40
- PHP PHP 5.4.41
- PHP PHP 5.4.42
- PHP PHP 5.4.43
- PHP PHP 5.4.44
- PHP PHP 5.4.45
- PHP PHP 5.4.5
- PHP PHP 5.4.6
- PHP PHP 5.4.7
- PHP PHP 5.4.8
- PHP PHP 5.4.9
- PHP PHP 5.5.0
- PHP PHP 5.5.1
- PHP PHP 5.5.10
- PHP PHP 5.5.11
- PHP PHP 5.5.12
- PHP PHP 5.5.13
- PHP PHP 5.5.14
- PHP PHP 5.5.15
- PHP PHP 5.5.16
- PHP PHP 5.5.17
- PHP PHP 5.5.18
- PHP PHP 5.5.19
- PHP PHP 5.5.2
- PHP PHP 5.5.20
- PHP PHP 5.5.21
- PHP PHP 5.5.22
- PHP PHP 5.5.23
- PHP PHP 5.5.24
- PHP PHP 5.5.25
- PHP PHP 5.5.26
- PHP PHP 5.5.27
- PHP PHP 5.5.28
- PHP PHP 5.5.29
- PHP PHP 5.5.3
- PHP PHP 5.5.30
- PHP PHP 5.5.31
- PHP PHP 5.5.32
- PHP PHP 5.5.33
- PHP PHP 5.5.34
- PHP PHP 5.5.35
- PHP PHP 5.5.36
- PHP PHP 5.5.37
- PHP PHP 5.5.38
- PHP PHP 5.5.4
- PHP PHP 5.5.5
- PHP PHP 5.5.6
- PHP PHP 5.5.7
- PHP PHP 5.5.8
- PHP PHP 5.5.9
- PHP PHP 5.6
- PHP PHP 5.6.0
- PHP PHP 5.6.1
- PHP PHP 5.6.10
- PHP PHP 5.6.11
- PHP PHP 5.6.12
- PHP PHP 5.6.13
- PHP PHP 5.6.14
- PHP PHP 5.6.17
- PHP PHP 5.6.18
- PHP PHP 5.6.19
- PHP PHP 5.6.2
- PHP PHP 5.6.20
- PHP PHP 5.6.21
- PHP PHP 5.6.22
- PHP PHP 5.6.23
- PHP PHP 5.6.24
- PHP PHP 5.6.25
- PHP PHP 5.6.26
- PHP PHP 5.6.27
- PHP PHP 5.6.28
- PHP PHP 5.6.29
- PHP PHP 5.6.3
- PHP PHP 5.6.30
- PHP PHP 5.6.31
- PHP PHP 5.6.32
- PHP PHP 5.6.33
- PHP PHP 5.6.34
- PHP PHP 5.6.35
- PHP PHP 5.6.36
- PHP PHP 5.6.37
- PHP PHP 5.6.38
- PHP PHP 5.6.39
- PHP PHP 5.6.4
- PHP PHP 5.6.6
- PHP PHP 5.6.7
- PHP PHP 5.6.8
- PHP PHP 5.6.9
- PHP PHP 7.0
- PHP PHP 7.0.0
- PHP PHP 7.0.1
- PHP PHP 7.0.10
- PHP PHP 7.0.11
- PHP PHP 7.0.12
- PHP PHP 7.0.13
- PHP PHP 7.0.14
- PHP PHP 7.0.15
- PHP PHP 7.0.16
- PHP PHP 7.0.17
- PHP PHP 7.0.2
- PHP PHP 7.0.21
- PHP PHP 7.0.22
- PHP PHP 7.0.25
- PHP PHP 7.0.26
- PHP PHP 7.0.27
- PHP PHP 7.0.29
- PHP PHP 7.0.3
- PHP PHP 7.0.30
- PHP PHP 7.0.31
- PHP PHP 7.0.33
- PHP PHP 7.0.4
- PHP PHP 7.0.5
- PHP PHP 7.0.6
- PHP PHP 7.0.7
- PHP PHP 7.0.8
- PHP PHP 7.0.9
- PHP PHP 7.1
- PHP PHP 7.1.0
- PHP PHP 7.1.1
- PHP PHP 7.1.11
- PHP PHP 7.1.12
- PHP PHP 7.1.13
- PHP PHP 7.1.14
- PHP PHP 7.1.16
- PHP PHP 7.1.17
- PHP PHP 7.1.2
- PHP PHP 7.1.20
- PHP PHP 7.1.24
- PHP PHP 7.1.25
- PHP PHP 7.1.3
- PHP PHP 7.1.4
- PHP PHP 7.1.5
- PHP PHP 7.1.6
- PHP PHP 7.1.7
- PHP PHP 7.1.8
- PHP PHP 7.1.9
- PHP PHP 7.2.0
- PHP PHP 7.2.1
- PHP PHP 7.2.12
- PHP PHP 7.2.13
- PHP PHP 7.2.2
- PHP PHP 7.2.3
- PHP PHP 7.2.4
- PHP PHP 7.2.5
- PHP PHP 7.2.6
- PHP PHP 7.2.7
- PHP PHP 7.2.8
- PHP PHP 7.3.0
Recommendations
Deploy network intrusion detection systems to monitor network traffic for malicious activity.
Deploy NIDS to monitor network traffic for signs of anomalous or suspicious activity. This includes but is not limited to requests that include NOP sleds and unexplained incoming and outgoing traffic. This may indicate exploit attempts or activity that results from successful exploits.
Do not accept or execute files from untrusted or unknown sources.
To reduce the likelihood of successful exploits, never handle files that originate from unfamiliar or untrusted sources.
Implement multiple redundant layers of security.
Various memory-protection schemes (such as nonexecutable and randomly mapped memory segments) may hinder an attacker’s ability to exploit this vulnerability to execute arbitrary code.
Vendor updates are available. Please see the references for more information.
Related
suse
suse
Security update for php5 (moderate)
2019-03-01 00:00:00
Security update for gd (moderate)
2019-04-05 00:00:00
Security update for gd (moderate)
2019-04-04 00:00:00
nessus
nessus
openSUSE Security Update : php5 (openSUSE-2019-276)
2019-03-04 00:00:00
Photon OS 2.0: Libgd PHSA-2019-2.0-0153
2019-05-15 00:00:00
SUSE SLES12 Security Update : php5 (SUSE-SU-2019:0449-1)
2019-02-21 00:00:00
osv
osv
CVE-2019-6977
2019-01-27 02:29:00
libgd2 - security update
2019-02-04 00:00:00
Moderate: gd security update
2020-11-03 12:24:40
openvas
openvas
openSUSE: Security Advisory for php5 (openSUSE-SU-2019:0276-1)
2019-03-02 00:00:00
SUSE: Security Advisory (SUSE-SU-2019:0449-1)
2021-06-09 00:00:00
Huawei EulerOS: Security Advisory for php (EulerOS-SA-2019-1251)
2020-01-23 00:00:00
f5
f5
K02412162 : PHP vulnerability CVE-2019-6977
2020-03-17 00:00:00
ubuntucve
ubuntucve
CVE-2019-6977
2019-01-26 00:00:00
veracode
veracode
Arbitrary Code Execution
2019-08-20 00:10:42
alpinelinux
alpinelinux
CVE-2019-6977
2019-01-27 02:29:00
packetstorm
packetstorm
PHP 7.2 imagecolormatch() Out-Of-Band Heap Write
2019-04-09 00:00:00
exploitpack
exploitpack
PHP 7.2 - imagecolormatch() Out of Band Heap Write
2019-02-27 00:00:00
debiancve
debiancve
CVE-2019-6977
2019-01-27 02:29:00
redhatcve
redhatcve
CVE-2019-6977
2020-04-05 17:05:22
hackerone
hackerone
Internet Bug Bounty: imagecolormatch Out Of Bounds Write on Heap
2019-01-12 00:46:15
prion
prion
Heap overflow
2019-01-27 02:29:00
cve
cve
CVE-2019-6977
2019-01-27 02:29:00
zdt
zdt
PHP 7.2 - imagecolormatch() Out of Band Heap Write Exploit
2019-04-09 00:00:00
myhack58
myhack58
exploitdb
exploitdb
PHP 7.2 - 'imagecolormatch()' Out of Band Heap Write
2019-02-27 00:00:00
fedora
fedora
[SECURITY] Fedora 30 Update: gd-2.2.5-9.fc30
2019-11-09 22:40:43
[SECURITY] Fedora 31 Update: gd-2.2.5-10.fc31
2019-11-18 22:47:51
[SECURITY] Fedora 29 Update: gd-2.2.5-8.fc29
2019-11-10 01:07:58
cloudfoundry
cloudfoundry
USN-3900-1: GD vulnerabilities | Cloud Foundry
2019-03-07 00:00:00
ubuntu
ubuntu
GD vulnerabilities
2019-02-28 00:00:00
debian
debian
[SECURITY] [DSA 4384-1] libgd2 security update
2019-02-04 20:58:09
[SECURITY] [DSA 4384-1] libgd2 security update
2019-02-04 20:58:09
[SECURITY] [DLA 1651-1] libgd2 security update
2019-01-30 20:45:03
ibm
ibm
Security Bulletin: IBM BladeCenter Advanced Management Module (AMM) is affected by vulnerabilities in PHP (CVE-2019-6977) (CVE-2019-6978)
2020-01-09 18:44:17
mageia
mageia
Updated libgd packages fix security vulnerability
2019-02-13 14:08:25
oraclelinux
oraclelinux
gd security update
2020-11-10 00:00:00
rocky
rocky
gd security update
2020-11-03 12:24:40
redhat
redhat
(RHSA-2020:4659) Moderate: gd security update
2020-11-03 12:24:40
(RHSA-2019:3299) Critical: rh-php72-php security update
2019-11-01 12:22:19
almalinux
almalinux
Moderate: gd security update
2020-11-03 12:24:40
gentoo
gentoo
GD: Multiple vulnerabilities
2019-03-28 00:00:00
photon
photon
Home
Download Photon OS
User Documentation
FAQ
Security Advisories
Related Information
Lightwave - PHSA-2019-2.0-0153
2019-04-25 00:00:00
Important Photon OS Security Update - PHSA-2019-0153
2019-04-25 00:00:00
Critical Photon OS Security Update - PHSA-2019-0002
2019-02-26 00:00:00
slackware
slackware
[slackware-security] gd
2020-03-23 20:45:50
rosalinux
rosalinux
Advisory ROSA-SA-2021-1950
2021-07-02 17:57:45
Related for SMNTC-106731