CVE-2017-6362 Double free vulnerability in the gdImagePngPtr function in libgd2 before 2.2.5 allows remote attackers to cause a denial of service via vectors related to a palette with no colors.
HighCVSS 7.5
EPSS 5.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Double free vulnerability in the gdImagePngPtr function in libgd2 before 2.2.5 allows remote attackers to cause a denial of service via vectors related to a palette with no colors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libgd2(Debian:12) | < 2.2.5-1 | 2.2.5-1 |
| debian/libgd2(Debian:13) | < 2.2.5-1 | 2.2.5-1 |
| debian/libgd2(Debian:14) | < 2.2.5-1 | 2.2.5-1 |
| libgd | = 2.2.4 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| fedoraproject fedora | = 26 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| alpine/gd(Alpine:v3.4) | < 2.2.5-r0 | 2.2.5-r0 |
| alpine/gd(Alpine:v3.5) | < 2.2.5-r0 | 2.2.5-r0 |
| alpine/gd(Alpine:v3.6) | < 2.2.5-r0 | 2.2.5-r0 |
References
- Debian Security Tracker CVE-2017-6362 vendor-advisory
- DSA-3961 third-party-advisory vendor-advisory
- github.com issue-tracking third-party-advisory
- github.com patch release-notes third-party-advisory
- FEDORA-2017-7cc0e6a5f5 vendor-advisory
- security.alpinelinux.org vendor-advisory