SB2015092642 - Debian update for libgd2
Published: September 26, 2015
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 secuirty vulnerabilities.
1) Buffer overflow (CVE-ID: CVE-2007-0455)
The vulnerability allows a remote attacker to cause DoS condition or execute arbitrary code on the target system.
The weakness exists in the gdImageStringFTEx function in gdft.c due to buffer overflow. A remote attacker can cause the service to crash or execute arbitrary code via a specially crafted string with a JIS encoded font.
Successful exploitation of the vulnerability may result in system comprmise.
2) Memory corruption (CVE-ID: CVE-2009-3546)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists in the _gdGetColors function in gd_gd.c due to improper verification of a certain colorsTotal structure member. A remote attacker can trick the victim into opening a specially crafted GD file, trigger buffer over-read or buffer overflow and execute arbitrary code.
Successful exploitation of the vulnerability may result in system compromise.
Remediation
Install update from vendor's website.