Out-of-bounds read in GD Graphics Library - CVE-2021-38115

Vulnerability identifier: #VU56412

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-38115

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition in the "ead_header_tga" in gd_tga.c. A remote attacker can send a specially crafted TGA file, trigger out-of-bounds read error and cause a denial of service condition on the system.

GD Graphics Library
cflinuxfs3
Ubuntu
openEuler
libgd3 (Ubuntu package)
gd
gd-devel
gd-debuginfo
gd-debugsource

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

cflinuxfs3 - update to 0.255.0
libgd3 (Ubuntu package) - addressed in versions Ubuntu Pro, 2.2.5-4ubuntu0.5, 2.2.5-5.2ubuntu2.1, 2.3.0-2ubuntu0.1
gd - update to 2.3.0-2
gd-devel - update to 2.3.0-2
gd-debuginfo - update to 2.3.0-2
gd-debugsource - update to 2.3.0-2

• https://github.com/libgd/libgd/pull/711/commits/8b111b2b4a4842179be66db68d84dda91a246032
• https://github.com/libgd/libgd/issues/697

• Denial of service in GD Graphics Library
• Multiple vulnerabilities in Cloud Foundry Foundation cflinuxfs3
• openEuler update for gd
• Ubuntu update for libgd2