Bug 277091 - (CVE-2007-3474) CVE-2007-3474 libgd Denial of service and reentrancy fixes in GIF code
CVE-2007-3474 libgd Denial of service and reentrancy fixes in GIF code
Status: CLOSED WONTFIX
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
http://nvd.nist.gov/nvd.cfm?cvename=C...
public=20070621,impact=low,source=cve...
: Security
Depends On: 277411 277421
Blocks:
  Show dependency treegraph
 
Reported: 2007-09-04 15:13 EDT by Lubomir Kundrak
Modified: 2008-02-13 11:15 EST (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-02-13 11:15:05 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Lubomir Kundrak 2007-09-04 15:13:01 EDT
Common Vulnerabilities and Exposures assigned an identifier CVE-2007-3474 to the following vulnerability:

Multiple unspecified vulnerabilities in the GIF reader in the GD Graphics Library (libgd) before 2.0.35 have unspecified impact and user-assisted remote attack vectors.

References:

http://www.libgd.org/ReleaseNote020035
http://bugs.php.net/bug.php?id=37360
http://bugs.php.net/bug.php?id=37346
http://bugs.libgd.org/?do=details&task_id=52
http://bugs.libgd.org/?do=details&task_id=60
Comment 1 Lubomir Kundrak 2007-09-04 15:29:26 EDT
"Unspecified" most likely means on of changes that fixed low impact security flaws:

A memory-leak with triggerable with a corrupted image that would eventually
consume all available memory and cause the process using gd to die. This is
usually not a problem when available memory memory is limited with setrlimit(2)
(typical case of PHP).

Some GIF handling functions did use static local variables and therefore were
not thread safe. This could be potentially exploited under a time-dependent race
condition to crash an application, or leak information. Possibility of this
happening is very low and it can only have security implications in
multi-threaded server application.
Comment 5 Tomas Hoger 2008-02-11 13:07:32 EST
This issue does not affect versions of gd as shipped with Red Hat Enterprise
Linux 2.1 and 3, as those versions do not offer GIF image type support.
Comment 6 Tomas Hoger 2008-02-13 11:15:05 EST
It's not really obvious what issues / fixes this CVE id should really refer to.
 Reentrancy / thread safety issues were tracked via:

http://bugs.libgd.org/?do=details&task_id=52

Fixes for other bugs were committed along with re-entrancy fix, but those issues
are not security sensitive:

http://bugs.libgd.org/?do=details&task_id=60
http://bugs.libgd.org/?do=details&task_id=66


We currently do not plan to backport a fix that makes GIF handling re-entrant as
security fix to gd packages in Red Hat Enterprise Linux 4, and 5 due to low
likelihood of application possibly affected by this problem being exposed in a
way that would allow trust boundary to be crossed.

Note You need to log in before you can comment on or make changes to this bug.