Executive Summary
Summary | |
---|---|
Title | New libgd1 packages fix arbitrary code execution |
Informations | |||
---|---|---|---|
Name | DSA-589 | First vendor Publication | 2004-11-09 |
Vendor | Debian | Last vendor Modification | 2004-11-09 |
Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C) | |||
---|---|---|---|
Cvss Base Score | 10 | Attack Range | Network |
Cvss Impact Score | 10 | Attack Complexity | Low |
Cvss Expoit Score | 10 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
"infamous41md" discovered several integer overflows in the PNG image decoding routines of the GD graphics library. This could lead to the execution of arbitrary code on the victim's machine. For the stable distribution (woody) these problems have been fixed in version 1.8.4-17.woody3 of libgd1 and in version 2.0.1-10woody1 of libgd2. For the unstable distribution (sid) these problems will be fixed soon. We recommend that you upgrade your libgd1 packages. |
Original Source
Url : http://www.debian.org/security/2004/dsa-589 |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:1260 | |||
Oval ID: | oval:org.mitre.oval:def:1260 | ||
Title: | Integer Overflow in libgd2 | ||
Description: | Integer overflow in GD Graphics Library libgd 2.0.28 (libgd2), and possibly other versions, allows remote attackers to cause a denial of service and possibly execute arbitrary code via PNG image files with large image rows values that lead to a heap-based buffer overflow in the gdImageCreateFromPngCtx function, a different set of vulnerabilities than CVE-2004-0941. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2004-0990 | Version: | 1 |
Platform(s): | Red Hat Enterprise Linux 3 | Product(s): | libgd |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:9952 | |||
Oval ID: | oval:org.mitre.oval:def:9952 | ||
Title: | Integer overflow in GD Graphics Library libgd 2.0.28 (libgd2), and possibly other versions, allows remote attackers to cause a denial of service and possibly execute arbitrary code via PNG image files with large image rows values that lead to a heap-based buffer overflow in the gdImageCreateFromPngCtx function, a different set of vulnerabilities than CVE-2004-0941. | ||
Description: | Integer overflow in GD Graphics Library libgd 2.0.28 (libgd2), and possibly other versions, allows remote attackers to cause a denial of service and possibly execute arbitrary code via PNG image files with large image rows values that lead to a heap-based buffer overflow in the gdImageCreateFromPngCtx function, a different set of vulnerabilities than CVE-2004-0941. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2004-0990 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 | Product(s): | |
Definition Synopsis: | |||
CPE : Common Platform Enumeration
OpenVAS Exploits
Date | Description |
---|---|
2009-10-10 | Name : SLES9: Security update for gd File : nvt/sles9p5021249.nasl |
2008-09-24 | Name : Gentoo Security Advisory GLSA 200411-08 (GD) File : nvt/glsa_200411_08.nasl |
2008-09-04 | Name : FreeBSD Ports: gd, uk-gd, ja-gd File : nvt/freebsd_gd.nasl |
2008-01-17 | Name : Debian Security Advisory DSA 589-1 (libgd) File : nvt/deb_589_1.nasl |
2008-01-17 | Name : Debian Security Advisory DSA 591-1 (libgd2) File : nvt/deb_591_1.nasl |
2008-01-17 | Name : Debian Security Advisory DSA 601-1 (libgd1) File : nvt/deb_601_1.nasl |
2008-01-17 | Name : Debian Security Advisory DSA 602-1 (libgd2) File : nvt/deb_602_1.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
11190 | GD Graphics Library PNG Handling gdImageCreateFromPngCtx() Overflow A remote overflow exists in GD Graphics Library. GD Graphics Library fails to check for an integer overflow when allocating memory for PNG image files in the gd_png.c gdImageCreateFromPngCtx() function. Using a specially crafted PNG image file, an attacker can cause a heap overflow and as a result remotely execute arbitrary code, leading to a loss of integrity. |
Snort® IPS/IDS
Date | Description |
---|---|
2014-12-23 | Microsoft and libpng multiple products PNG large image width overflow attempt RuleID : 32889-community - Revision : 2 - Type : FILE-IMAGE |
2015-01-23 | Microsoft and libpng multiple products PNG large image width overflow attempt RuleID : 32889 - Revision : 2 - Type : FILE-IMAGE |
2014-01-10 | Microsoft PNG large colour depth download attempt RuleID : 3134-community - Revision : 14 - Type : FILE-IMAGE |
2014-01-10 | Microsoft PNG large colour depth download attempt RuleID : 3134 - Revision : 14 - Type : FILE-IMAGE |
2014-01-10 | Microsoft Multiple Products PNG large image height download attempt RuleID : 3133-community - Revision : 15 - Type : FILE-IMAGE |
2014-01-10 | Microsoft Multiple Products PNG large image height download attempt RuleID : 3133 - Revision : 15 - Type : FILE-IMAGE |
2014-01-10 | Microsoft and libpng multiple products PNG large image width overflow attempt RuleID : 3132-community - Revision : 15 - Type : FILE-IMAGE |
2014-01-10 | Microsoft and libpng multiple products PNG large image width overflow attempt RuleID : 3132 - Revision : 15 - Type : FILE-IMAGE |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2015-07-16 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_ca139c7f2a8c11e5a4a5002590263bf5.nasl - Type : ACT_GATHER_INFO |
2009-04-23 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_622399682f2a11d9a9e70001020eed82.nasl - Type : ACT_GATHER_INFO |
2006-07-17 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-122.nasl - Type : ACT_GATHER_INFO |
2006-07-03 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2004-638.nasl - Type : ACT_GATHER_INFO |
2006-06-29 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-114.nasl - Type : ACT_GATHER_INFO |
2006-06-28 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-113.nasl - Type : ACT_GATHER_INFO |
2006-01-15 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-33-1.nasl - Type : ACT_GATHER_INFO |
2006-01-15 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-25-1.nasl - Type : ACT_GATHER_INFO |
2006-01-15 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-21-1.nasl - Type : ACT_GATHER_INFO |
2006-01-15 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-11-1.nasl - Type : ACT_GATHER_INFO |
2004-12-17 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2004-638.nasl - Type : ACT_GATHER_INFO |
2004-11-30 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-601.nasl - Type : ACT_GATHER_INFO |
2004-11-30 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-602.nasl - Type : ACT_GATHER_INFO |
2004-11-17 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2004-132.nasl - Type : ACT_GATHER_INFO |
2004-11-17 | Name : The remote Fedora Core host is missing a security update. File : fedora_2004-412.nasl - Type : ACT_GATHER_INFO |
2004-11-17 | Name : The remote Fedora Core host is missing a security update. File : fedora_2004-411.nasl - Type : ACT_GATHER_INFO |
2004-11-10 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-591.nasl - Type : ACT_GATHER_INFO |
2004-11-10 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-589.nasl - Type : ACT_GATHER_INFO |
2004-11-04 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200411-08.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 11:33:35 |
|