Bug 1600727 (CVE-2018-14553)

Summary: CVE-2018-14553 gd: NULL pointer dereference in gdImageClone
Product: [Other] Security Response Reporter: Pedro Sampaio <psampaio>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: databases-maint, fedora, fjanus, hhorak, jmlich83, jmoskovc, jorton, mskalicky, odubaj, panovotn, rcollet, security-response-team, webstack-team
Target Milestone: ---Keywords: Reopened, Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-11-04 02:21:16 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1802087, 1811788    
Bug Blocks: 1600729    

Description Pedro Sampaio 2018-07-12 20:52:34 UTC 
A flaw was found in gd as shipped with Fedora. Cloning a image with style "attached", triggers a NULL pointer dereference in 'gdImageClone' leading to denial of service.

Affected versions:
	
gd-2.2.5
gd-2.2.4
gd-2.2.3
gd-2.2.2
gd-2.2.1
gd-2.2.0
gd-2.1.1
gd-2.1.0
gd-2.1.0-rc2

References:

https://bugzilla.redhat.com/show_bug.cgi?id=1599032
Comment 1 msiddiqu 2020-02-12 10:43:09 UTC 
Upstream commit:

https://github.com/fcabralpacheco/libgd/commit/441cbfed60ebf6cb63b8ce120ed0a82b15e7aaf8

Upstream pull request:

https://github.com/libgd/libgd/pull/580
Comment 2 msiddiqu 2020-02-12 10:47:27 UTC 
Created gd tracking bugs for this issue:

Affects: fedora-all [bug 1802087]
Comment 3 Filip Januš 2020-02-12 12:24:37 UTC 
Already fix here:
https://bugzilla.redhat.com/show_bug.cgi?id=1599032

All builds in stable:
https://bodhi.fedoraproject.org/updates/FEDORA-2020-6bef0d0c5c
https://bodhi.fedoraproject.org/updates/FEDORA-2020-dad5230359
https://bodhi.fedoraproject.org/updates/FEDORA-2020-dd0a88b7a9

*** This bug has been marked as a duplicate of bug 1599032 ***
Comment 6 Product Security DevOps Team 2020-11-04 02:21:16 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-14553
Comment 7 errata-xmlrpc 2020-11-04 02:44:43 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:4659 https://access.redhat.com/errata/RHSA-2020:4659