Veracode Vulnerability DatabaseVERACODE:22490Denial Of Service (DoS)
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
libgd.so is vulnerable to denial of service (DoS). The attacker can crash the application by providing a malicious input to the function gdImageClone in gd.c , leading to a null pointer dereference for not properly checking styleLength value.
References
lists.opensuse.org/opensuse-security-announce/2020-03/msg00020.html
bugzilla.redhat.com/show_bug.cgi?id=1599032
github.com/fcabralpacheco/libgd/commit/441cbfed60ebf6cb63b8ce120ed0a82b15e7aaf8
github.com/libgd/libgd/commit/a93eac0e843148dc2d631c3ba80af17e9c8c860f
github.com/libgd/libgd/pull/580
lists.debian.org/debian-lts-announce/2020/02/msg00014.html
lists.fedoraproject.org/archives/list/[email protected]/message/3CZ2QADQTKRHTGB2AHD7J4QQNDLBEMM6/
usn.ubuntu.com/4316-1/
usn.ubuntu.com/4316-2/
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P