Bug 1417987 (CVE-2016-9317)

Summary:	CVE-2016-9317 gd: Missing check for oversized images in gdImageCreate()
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abhgupta, caolanm, carl_song, databases-maint, dmcphers, fedora, hhorak, huzaifas, jialiu, jmlich83, jokerman, jorton, jrusnack, kseifried, lmeyer, mmccomas, mskalick, rcollet, security-response-team, tiwillia, trepik, varekova, webstack-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-10-05 06:33:39 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1418992
Bug Blocks:	1417990

Description Adam Mariš 2017-01-31 14:37:45 UTC

The gdImageCreate function in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of service (system hang) via an oversized image.

Upstream patch:

https://github.com/libgd/libgd/commit/1846f48e5fcdde996e7c27a4bbac5d0aef183e4b

Comment 1 Adam Mariš 2017-02-03 11:32:29 UTC

Created libwmf tracking bugs for this issue:

Affects: fedora-all [bug 1418992]

Comment 2 Carl Song 2017-05-31 15:17:09 UTC

There has been no movement on this issue for four months. Is this going to be worked on?

Comment 3 Huzaifa S. Sidhpurwala 2017-06-07 06:08:36 UTC

(In reply to Carl Song from comment #2)
> There has been no movement on this issue for four months. Is this going to
> be worked on?

Still working on this one, should have the affects by the end of this week.

Comment 4 Huzaifa S. Sidhpurwala 2018-04-01 02:15:29 UTC

The previous upstream patch described in comment #0 just adds whitespaces to the code. It seems like the actual patch is at:

https://github.com/libgd/libgd/commit/c3cf674cb444696a36f720f785878b41225af063#diff-2ebe418bf93ac39773a117e4b38fe86a