Red Hat Bugzilla – Bug 276791
CVE-2007-3473 libgd NULL pointer dereference when reading a corrupt X bitmap
Last modified: 2016-03-04 06:58:16 EST
Common Vulnerabilities and Exposures assigned an identifier CVE-2007-3473 to the following vulnerability:
The gdImageCreateXbm function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors involving a gdImageCreate failure.
On failure, gdImageCreate() returns NULL which is in turn dereferenced by
gdImageCreateFromXbm() (gdImageCreateXbm doesn't exist at all).
Following SecWeb advisory seems to provide reproducer for this issue:
Note that this advisory describes different issue in the text -- integer
overflow in gdImageCreateTrueColor, known as CVE-2007-3472. I'm not sure why
gdImageCreateFromXbm was used as an example in PoC, as this function only calls
gdImageCreate (i.e. non-TrueColor version, not affected by the overflow).
Updated gd packages addressing this issue were released for Red Hat Enterprise
Linux 4 and 5:
Closing this issue out as the errata shipped in February 2008.
Please do not close 'Security Response' bugs that may be left open intentionally. Thank you!
Reporter changed to email@example.com by request of Jay Turner.
Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates to libwmf on Red Hat Enterprise Linux 5 and 6. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.