Package name
gd
Date
2008-02-07
Advisory ID
MDVSA-2008:038
Affected versions
CS4.0 x86_64 , CS4.0 i586 , 2007.0 x86_64 , 2007.0 i586

Problem description

Buffer overflow in the LWZReadByte() function in gd_gif_in.c in GD
prior to 2.0.34 allows remote attackers to have an unknown impact
via a GIF file with input_code_size greater than MAX_LWZ_BITS, which
triggers an overflow when initializing the table array.

This was originally fixed in PHP's embedded GD with MDKSA-2006:162;
patches had not been applied to the system libgd at that time.

The updated packages have been patched to correct this issue.

Updated packages

CS4.0 x86_64

 26e334153150600c8e21426b6c89fc0d  corporate/4.0/x86_64/gd-utils-2.0.33-3.5.20060mlcs4.x86_64.rpm
 85d6fb1d0e366fc02eea92d87f002775  corporate/4.0/x86_64/lib64gd2-2.0.33-3.5.20060mlcs4.x86_64.rpm
 0f3986d317e0e6e4923bee69763d4d2a  corporate/4.0/x86_64/lib64gd2-devel-2.0.33-3.5.20060mlcs4.x86_64.rpm
 551c1c5d3bf54340241cbfa1a7f0d5e2  corporate/4.0/x86_64/lib64gd2-static-devel-2.0.33-3.5.20060mlcs4.x86_64.rpm 
 638e3d6d0cad46ec00cd8005356fe96f  corporate/4.0/SRPMS/gd-2.0.33-3.5.20060mlcs4.src.rpm

CS4.0 i586

 dd213d40ce5d217db62bba839f38228b  corporate/4.0/i586/gd-utils-2.0.33-3.5.20060mlcs4.i586.rpm
 e3ce9ac16ccebcd9e974191766851d73  corporate/4.0/i586/libgd2-2.0.33-3.5.20060mlcs4.i586.rpm
 974858ee8531fa339fd54f7ad435bbd1  corporate/4.0/i586/libgd2-devel-2.0.33-3.5.20060mlcs4.i586.rpm
 4651b8752a4631e9d4139d59c6f423f5  corporate/4.0/i586/libgd2-static-devel-2.0.33-3.5.20060mlcs4.i586.rpm 
 638e3d6d0cad46ec00cd8005356fe96f  corporate/4.0/SRPMS/gd-2.0.33-3.5.20060mlcs4.src.rpm

2007.0 x86_64

 4415599217e596438138f1d38d569b2e  2007.0/x86_64/gd-utils-2.0.33-5.4mdv2007.0.x86_64.rpm
 b80f2b86c307a423f4c5da9db8740498  2007.0/x86_64/lib64gd2-2.0.33-5.4mdv2007.0.x86_64.rpm
 b25700d218143ab19630a273859ca8cf  2007.0/x86_64/lib64gd2-devel-2.0.33-5.4mdv2007.0.x86_64.rpm
 edc68e77faefc49c3f003fe16f7456a1  2007.0/x86_64/lib64gd2-static-devel-2.0.33-5.4mdv2007.0.x86_64.rpm 
 c3d0c5fcdd6c91952dc9c26941806b4f  2007.0/SRPMS/gd-2.0.33-5.4mdv2007.0.src.rpm

2007.0 i586

 5d27c4f586379090e4931a21d33fd7b4  2007.0/i586/gd-utils-2.0.33-5.4mdv2007.0.i586.rpm
 9224f8e7e3592e7002bf7e52ab11c03f  2007.0/i586/libgd2-2.0.33-5.4mdv2007.0.i586.rpm
 1d703d7be910a24975b4ebe18aeb7dd3  2007.0/i586/libgd2-devel-2.0.33-5.4mdv2007.0.i586.rpm
 9f2a55d0b08203ea04d1a7ef9350f193  2007.0/i586/libgd2-static-devel-2.0.33-5.4mdv2007.0.i586.rpm 
 c3d0c5fcdd6c91952dc9c26941806b4f  2007.0/SRPMS/gd-2.0.33-5.4mdv2007.0.src.rpm

References