Bug 277091 (CVE-2007-3474) - CVE-2007-3474 libgd Denial of service and reentrancy fixes in GIF code
Summary: CVE-2007-3474 libgd Denial of service and reentrancy fixes in GIF code
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2007-3474
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL: http://nvd.nist.gov/nvd.cfm?cvename=C...
Whiteboard: public=20070621,impact=low,source=cve...
Depends On: 277411 277421
Blocks:
TreeView+ depends on / blocked
 
Reported: 2007-09-04 19:13 UTC by Lubomir Kundrak
Modified: 2019-06-08 12:22 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2008-02-13 16:15:05 UTC


Attachments (Terms of Use)

Description Lubomir Kundrak 2007-09-04 19:13:01 UTC
Common Vulnerabilities and Exposures assigned an identifier CVE-2007-3474 to the following vulnerability:

Multiple unspecified vulnerabilities in the GIF reader in the GD Graphics Library (libgd) before 2.0.35 have unspecified impact and user-assisted remote attack vectors.

References:

http://www.libgd.org/ReleaseNote020035
http://bugs.php.net/bug.php?id=37360
http://bugs.php.net/bug.php?id=37346
http://bugs.libgd.org/?do=details&task_id=52
http://bugs.libgd.org/?do=details&task_id=60

Comment 1 Lubomir Kundrak 2007-09-04 19:29:26 UTC
"Unspecified" most likely means on of changes that fixed low impact security flaws:

A memory-leak with triggerable with a corrupted image that would eventually
consume all available memory and cause the process using gd to die. This is
usually not a problem when available memory memory is limited with setrlimit(2)
(typical case of PHP).

Some GIF handling functions did use static local variables and therefore were
not thread safe. This could be potentially exploited under a time-dependent race
condition to crash an application, or leak information. Possibility of this
happening is very low and it can only have security implications in
multi-threaded server application.

Comment 5 Tomas Hoger 2008-02-11 18:07:32 UTC
This issue does not affect versions of gd as shipped with Red Hat Enterprise
Linux 2.1 and 3, as those versions do not offer GIF image type support.

Comment 6 Tomas Hoger 2008-02-13 16:15:05 UTC
It's not really obvious what issues / fixes this CVE id should really refer to.
 Reentrancy / thread safety issues were tracked via:

http://bugs.libgd.org/?do=details&task_id=52

Fixes for other bugs were committed along with re-entrancy fix, but those issues
are not security sensitive:

http://bugs.libgd.org/?do=details&task_id=60
http://bugs.libgd.org/?do=details&task_id=66


We currently do not plan to backport a fix that makes GIF handling re-entrant as
security fix to gd packages in Red Hat Enterprise Linux 4, and 5 due to low
likelihood of application possibly affected by this problem being exposed in a
way that would allow trust boundary to be crossed.



Note You need to log in before you can comment on or make changes to this bug.