Univention Bugzilla – Full Text Bug Listing |
Summary: | libgd2: Denial of service (4.0) | ||
---|---|---|---|
Product: | UCS | Reporter: | Moritz Muehlenhoff <jmm> |
Component: | Security updates | Assignee: | Felix Botner <botner> |
Status: | CLOSED FIXED | QA Contact: | Daniel Tröder <troeder> |
Severity: | normal | ||
Priority: | P4 | CC: | gohmann, requate, walkenhorst |
Version: | UCS 4.0 | Flags: | requate:
Patch_Available+
|
Target Milestone: | UCS 4.0-3-errata | ||
Hardware: | Other | ||
OS: | Linux | ||
What kind of report is it?: | --- | What type of bug is this?: | --- |
Who will be affected by this bug?: | --- | How will those affected feel about the bug?: | --- |
User Pain: | Enterprise Customer affected?: | ||
School Customer affected?: | ISV affected?: | ||
Waiting Support: | Flags outvoted (downgraded) after PO Review: | ||
Ticket number: | Bug group (optional): | ||
Max CVSS v3 score: |
Description
Moritz Muehlenhoff
2014-11-27 12:15:07 CET
CVE-2014-9709 Potential crash of long running service due to buffer read overflow in gd_gif_in.c when reading crafted GIFs. Fixed in upstream Debian package version 2.0.36~rc1~dfsg-6.1+deb7u1 2.0.36~rc1~dfsg-6.1+deb7u1 imported from wheezy and built in errata4.0-3 YAML: 2015-09-11-libgd2.yaml OK: DEBIAN_FRONTEND=noninteractive apt-get install -y libgd2-noxpm OK: Test: * repository/online/unmaintained=true * aptitude install libgd-tools * wget https://www.univention.de/wp-content/uploads/2014/07/UCS_Logo_974x169_auf_transparent-e1428568384183.png -O Ulogo.png * pngtogd2 Ulogo.png Ulogo.gd2 1 2 && echo OK * gd2topng Ulogo.gd2 Ulogo2.png && echo OK YAML was amended by QA (r63834+r63835), adding a note regarding CVE-2014-9709. |