Red Hat Bugzilla – Bug 277091
CVE-2007-3474 libgd Denial of service and reentrancy fixes in GIF code
Last modified: 2008-02-13 11:15:05 EST
Common Vulnerabilities and Exposures assigned an identifier CVE-2007-3474 to the following vulnerability:
Multiple unspecified vulnerabilities in the GIF reader in the GD Graphics Library (libgd) before 2.0.35 have unspecified impact and user-assisted remote attack vectors.
"Unspecified" most likely means on of changes that fixed low impact security flaws:
A memory-leak with triggerable with a corrupted image that would eventually
consume all available memory and cause the process using gd to die. This is
usually not a problem when available memory memory is limited with setrlimit(2)
(typical case of PHP).
Some GIF handling functions did use static local variables and therefore were
not thread safe. This could be potentially exploited under a time-dependent race
condition to crash an application, or leak information. Possibility of this
happening is very low and it can only have security implications in
multi-threaded server application.
Patch against 2.0.33 as used by rPath:
This issue does not affect versions of gd as shipped with Red Hat Enterprise
Linux 2.1 and 3, as those versions do not offer GIF image type support.
It's not really obvious what issues / fixes this CVE id should really refer to.
Reentrancy / thread safety issues were tracked via:
Fixes for other bugs were committed along with re-entrancy fix, but those issues
are not security sensitive:
We currently do not plan to backport a fix that makes GIF handling re-entrant as
security fix to gd packages in Red Hat Enterprise Linux 4, and 5 due to low
likelihood of application possibly affected by this problem being exposed in a
way that would allow trust boundary to be crossed.