Bug 276791 (CVE-2007-3473)
Summary: | CVE-2007-3473 libgd NULL pointer dereference when reading a corrupt X bitmap | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Red Hat Product Security <security-response-team> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED ERRATA | QA Contact: | |
Severity: | low | Docs Contact: | |
Priority: | low | ||
Version: | unspecified | CC: | kreilly, varekova |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
URL: | http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-3473 | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | Bug Fix | |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2015-02-17 15:18:49 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 277411, 277421, 432784, 432785, 432786, 432787, 833899 | ||
Bug Blocks: |
Description
Lubomir Kundrak
2007-09-04 17:49:40 UTC
On failure, gdImageCreate() returns NULL which is in turn dereferenced by gdImageCreateFromXbm() (gdImageCreateXbm doesn't exist at all). Upstream commit: http://cvs.php.net/viewcvs.cgi/gd/libgd/src/gd.c?r1=1.62&r2=1.63 Following SecWeb advisory seems to provide reproducer for this issue: http://www.secweb.se/en/advisories/gd-gdimagecreatetruecolor-integer-overflow/ Note that this advisory describes different issue in the text -- integer overflow in gdImageCreateTrueColor, known as CVE-2007-3472. I'm not sure why gdImageCreateFromXbm was used as an example in PoC, as this function only calls gdImageCreate (i.e. non-TrueColor version, not affected by the overflow). Updated gd packages addressing this issue were released for Red Hat Enterprise Linux 4 and 5: https://rhn.redhat.com/errata/RHSA-2008-0146.html Closing this issue out as the errata shipped in February 2008. Please do not close 'Security Response' bugs that may be left open intentionally. Thank you! Reporter changed to security-response-team by request of Jay Turner. Statement: Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates to libwmf on Red Hat Enterprise Linux 5 and 6. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/. |