Bug 1671390 (CVE-2019-6978) - CVE-2019-6978 gd: Double free in the gdImage*Ptr in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c
Summary: CVE-2019-6978 gd: Double free in the gdImage*Ptr in gd_gif_out.c, gd_jpeg.c, ...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-6978
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1671391 1671392 1679002 1679003 1679005 1679006 1717799
Blocks: 1671394
TreeView+ depends on / blocked
 
Reported: 2019-01-31 14:12 UTC by Laura Pardo
Modified: 2020-12-17 11:07 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-09-12 12:45:38 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:2722 0 None None None 2019-09-11 09:34:26 UTC
Red Hat Product Errata RHSA-2020:3943 0 None None None 2020-09-29 20:00:20 UTC
Red Hat Product Errata RHSA-2020:4659 0 None None None 2020-11-04 02:44:46 UTC

Description Laura Pardo 2019-01-31 14:12:57 UTC 
The GD Graphics Library (aka LibGD) 2.2.5 has a double free in the gdImage*Ptr() functions in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c. NOTE: PHP is unaffected.


References:
https://github.com/libgd/libgd/issues/492

Upstream Patch:
https://github.com/libgd/libgd/commit/553702980ae89c83f2d6e254d62cf82e204956d0
https://github.com/php/php-src/commit/089f7c0bc28d399b0420aa6ef058e4c1c120b2ae
Comment 1 Laura Pardo 2019-01-31 14:13:12 UTC 
Created gd tracking bugs for this issue:

Affects: fedora-all [bug 1671391]


Created libwmf tracking bugs for this issue:

Affects: fedora-all [bug 1671392]
Comment 2 Huzaifa S. Sidhpurwala 2019-02-20 04:54:55 UTC 
Analysis:

Basically a double-free in the gd library when handling gdImage Pointers. Can result in application crash. However you need need the gdImage*Ctx (where * is git, Jpeg or Wbmp) to fail.
Comment 7 errata-xmlrpc 2019-09-11 09:34:25 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:2722 https://access.redhat.com/errata/RHSA-2019:2722
Comment 8 Product Security DevOps Team 2019-09-12 12:45:38 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-6978
Comment 9 errata-xmlrpc 2020-09-29 20:00:18 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:3943 https://access.redhat.com/errata/RHSA-2020:3943
Comment 10 errata-xmlrpc 2020-11-04 02:44:46 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:4659 https://access.redhat.com/errata/RHSA-2020:4659
Note You need to log in before you can comment on or make changes to this bug.