Veracode Vulnerability DatabaseVERACODE:20418Buffer Overflow
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
libgd.so is vulnerable to buffer overflow. The attacker can send a malicious gd2 palette image exceeding a maximum color value gdMaxColors in the function _gdGetColors to trigger a buffer overrun.
| CPE | Name | Operator | Version |
|---|---|---|---|
| libgd.so | le | 2.0.0 | |
| php | eq | 5.1.6__11.el5 | |
| php | eq | 5.1.6__5.el5 | |
| php | eq | 5.1.6__12.el5 | |
| php | eq | 5.1.6__20.el5 | |
| php | eq | 5.1.6__23.el5 | |
| php | eq | 5.1.6__15.el5 | |
| php | eq | 5.1.6__7.el5 | |
| php | eq | 5.1.6__20.el5_2.1 | |
| php | eq | 5.1.6__23.2.el5_3 |
References
marc.info/?l=oss-security&m=125562113503923&w=2
secunia.com/advisories/37069
secunia.com/advisories/37080
secunia.com/advisories/38055
svn.php.net/viewvc?view=revision&revision=289557
www.mandriva.com/security/advisories?name=MDVSA-2009:285
www.openwall.com/lists/oss-security/2009/11/20/5
www.redhat.com/support/errata/RHSA-2010-0003.html
www.securityfocus.com/bid/36712
www.vupen.com/english/advisories/2009/2929
www.vupen.com/english/advisories/2009/2930
access.redhat.com/errata/RHSA-2010:0003
access.redhat.com/errata/RHSA-2010:0040
access.redhat.com/security/cve/CVE-2009-3546
bugzilla.redhat.com/show_bug.cgi?id=529213
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11199
Related
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C