National Cyber-Alert System

Vulnerability Summary for CVE-2007-2756

Overview

The gdPngReadData function in libgd 2.0.34 allows user-assisted attackers to cause a denial of service (CPU consumption) via a crafted PNG image with truncated data, which causes an infinite loop in the png_read_info function in libpng.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Vendor Statments (disclaimer)

Official Statement from Red Hat (05/22/2007)

Red Hat does not consider this flaw to be a security vulnerability. We are not aware of any long running processes using libgd which could not recover from this condition.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: http://bugs.libgd.org/?do=details&task_id=86

Type: Patch Information

Hyperlink:http://bugs.libgd.org/?do=details&task_id=86

External Source: FEDORA

Name: FEDORA-2007-2215

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00397.html

External Source: FEDORA

Name: FEDORA-2007-709

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00354.html

External Source: CONFIRM

Name: https://issues.rpath.com/browse/RPL-1394

Hyperlink:https://issues.rpath.com/browse/RPL-1394

External Source: XF

Name: gd-gdpngreaddata-dos(34420)

Hyperlink:http://xforce.iss.net/xforce/xfdb/34420

External Source: UBUNTU

Name: USN-473-1

Hyperlink:http://www.ubuntu.com/usn/usn-473-1

External Source: TRUSTIX

Name: 2007-0023

Hyperlink:http://www.trustix.org/errata/2007/0023/

External Source: TRUSTIX

Name: 2007-0019

Hyperlink:http://www.trustix.org/errata/2007/0019/

External Source: SECTRACK

Name: 1018187

Hyperlink:http://www.securitytracker.com/id?1018187

External Source: BID

Name: 24089

Hyperlink:http://www.securityfocus.com/bid/24089

External Source: REDHAT

Name: RHSA-2008:0146

Hyperlink:http://www.redhat.com/support/errata/RHSA-2008-0146.html

External Source: REDHAT

Name: RHSA-2007:0891

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-0891.html

External Source: REDHAT

Name: RHSA-2007:0890

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-0890.html

External Source: CONFIRM

Name: http://www.php.net/releases/5_2_3.php

Hyperlink:http://www.php.net/releases/5_2_3.php

External Source: OPENPKG

Name: OpenPKG-SA-2007.020

Hyperlink:http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.020.html

External Source: SUSE

Name: SUSE-SR:2007:013

Hyperlink:http://www.novell.com/linux/security/advisories/2007_13_sr.html

External Source: MANDRIVA

Name: MDKSA-2007:187

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2007:187

External Source: MANDRIVA

Name: MDKSA-2007:124

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2007:124

External Source: MANDRIVA

Name: MDKSA-2007:123

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2007:123

External Source: MANDRIVA

Name: MDKSA-2007:122

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2007:122

External Source: CONFIRM

Name: http://www.libgd.org/ReleaseNote020035

Hyperlink:http://www.libgd.org/ReleaseNote020035

External Source: GENTOO

Name: GLSA-200710-02

Hyperlink:http://www.gentoo.org/security/en/glsa/glsa-200710-02.xml

External Source: VUPEN

Name: ADV-2007-3386

Hyperlink:http://www.frsirt.com/english/advisories/2007/3386

External Source: VUPEN

Name: ADV-2007-2336

Hyperlink:http://www.frsirt.com/english/advisories/2007/2336

External Source: VUPEN

Name: ADV-2007-2016

Hyperlink:http://www.frsirt.com/english/advisories/2007/2016

External Source: VUPEN

Name: ADV-2007-1905

Hyperlink:http://www.frsirt.com/english/advisories/2007/1905

External Source: VUPEN

Name: ADV-2007-1904

Hyperlink:http://www.frsirt.com/english/advisories/2007/1904

External Source: CONFIRM

Name: http://support.avaya.com/elmodocs2/security/ASA-2007-449.htm

Hyperlink:http://support.avaya.com/elmodocs2/security/ASA-2007-449.htm

External Source: SLACKWARE

Name: SSA:2007-152-01

Hyperlink:http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.482863

External Source: GENTOO

Name: GLSA-200805-13

Hyperlink:http://security.gentoo.org/glsa/glsa-200805-13.xml

External Source: GENTOO

Name: GLSA-200711-34

Hyperlink:http://security.gentoo.org/glsa/glsa-200711-34.xml

External Source: GENTOO

Name: GLSA-200708-05

Hyperlink:http://security.gentoo.org/glsa/glsa-200708-05.xml

External Source: SECUNIA

Name: 30168

Hyperlink:http://secunia.com/advisories/30168

External Source: SECUNIA

Name: 29157

Hyperlink:http://secunia.com/advisories/29157

External Source: SECUNIA

Name: 27545

Hyperlink:http://secunia.com/advisories/27545

External Source: SECUNIA

Name: 27110

Hyperlink:http://secunia.com/advisories/27110

External Source: SECUNIA

Name: 27102

Hyperlink:http://secunia.com/advisories/27102

External Source: SECUNIA

Name: 27037

Hyperlink:http://secunia.com/advisories/27037

External Source: SECUNIA

Name: 26967

Hyperlink:http://secunia.com/advisories/26967

External Source: SECUNIA

Name: 26930

Hyperlink:http://secunia.com/advisories/26930

External Source: SECUNIA

Name: 26895

Hyperlink:http://secunia.com/advisories/26895

External Source: SECUNIA

Name: 26871

Hyperlink:http://secunia.com/advisories/26871

External Source: SECUNIA

Name: 26390

Hyperlink:http://secunia.com/advisories/26390

External Source: SECUNIA

Name: 26231

Hyperlink:http://secunia.com/advisories/26231

External Source: SECUNIA

Name: 26048

Hyperlink:http://secunia.com/advisories/26048

External Source: SECUNIA

Name: 25855

Hyperlink:http://secunia.com/advisories/25855

External Source: SECUNIA

Name: 25787

Hyperlink:http://secunia.com/advisories/25787

External Source: SECUNIA

Name: 25658

Hyperlink:http://secunia.com/advisories/25658

External Source: SECUNIA

Name: 25657

Hyperlink:http://secunia.com/advisories/25657

External Source: SECUNIA

Name: 25646

Hyperlink:http://secunia.com/advisories/25646

External Source: SECUNIA

Name: 25590

Hyperlink:http://secunia.com/advisories/25590

External Source: SECUNIA

Name: 25575

Hyperlink:http://secunia.com/advisories/25575

External Source: SECUNIA

Name: 25535

Hyperlink:http://secunia.com/advisories/25535

External Source: SECUNIA

Name: 25378

Hyperlink:http://secunia.com/advisories/25378

External Source: SECUNIA

Name: 25362

Hyperlink:http://secunia.com/advisories/25362

External Source: SECUNIA

Name: 25353

Hyperlink:http://secunia.com/advisories/25353

External Source: REDHAT

Name: RHSA-2007:0889

Hyperlink:http://rhn.redhat.com/errata/RHSA-2007-0889.html

External Source: SUSE

Name: SUSE-SA:2007:044

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2007-07/msg00006.html

External Source: HP

Name: HPSBUX02262

Hyperlink:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795