Common Vulnerabilities and Exposures assigned an identifier CVE-2007-3473 to the following vulnerability: The gdImageCreateXbm function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors involving a gdImageCreate failure. References: http://bugs.libgd.org/?do=details&task_id=94 http://www.libgd.org/ReleaseNote020035 http://news.php.net/php.gd.cvs/235
On failure, gdImageCreate() returns NULL which is in turn dereferenced by gdImageCreateFromXbm() (gdImageCreateXbm doesn't exist at all).
http://news.php.net/php.gd.cvs/235
Upstream commit: http://cvs.php.net/viewcvs.cgi/gd/libgd/src/gd.c?r1=1.62&r2=1.63 Following SecWeb advisory seems to provide reproducer for this issue: http://www.secweb.se/en/advisories/gd-gdimagecreatetruecolor-integer-overflow/ Note that this advisory describes different issue in the text -- integer overflow in gdImageCreateTrueColor, known as CVE-2007-3472. I'm not sure why gdImageCreateFromXbm was used as an example in PoC, as this function only calls gdImageCreate (i.e. non-TrueColor version, not affected by the overflow).
Updated gd packages addressing this issue were released for Red Hat Enterprise Linux 4 and 5: https://rhn.redhat.com/errata/RHSA-2008-0146.html
Closing this issue out as the errata shipped in February 2008.
Please do not close 'Security Response' bugs that may be left open intentionally. Thank you!
Reporter changed to security-response-team by request of Jay Turner.
Statement: Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates to libwmf on Red Hat Enterprise Linux 5 and 6. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.