PatchTheCVEgdlib vulnerabilities and fixes
Recent CVEs affecting gdlib, with upgrade or downgrade steps. 5 tracked.
gdlib has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2007-06-28. Highest priority: CVE-2004-0990 (score 70/100).
- CVE-2007-3478 MEDIUM 4.3 UPGRADE Race condition in gdImageStringFTEx (gdft_draw_bitmap) in gdft.c in the GD Graphics Library (libgd) before 2.0
- CVE-2007-3476 MEDIUM 4.3 UPGRADE Array index error in gd_gif_in.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote
- CVE-2007-3475 MEDIUM 4.3 UPGRADE The GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of servi
- CVE-2004-0990 HIGH 10.0 DOWNGRADE DOWNGRADE Integer overflow in GD Graphics Library libgd 2.0.28 (libgd2), and possibly other versions, allows remote atta
- CVE-2004-0941 HIGH 10.0 DOWNGRADE MITIGATE Multiple buffer overflows in the gd graphics library (libgd) 2.0.21 and earlier may allow remote attackers to
FAQ
How do I fix gdlib vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is gdlib being exploited right now?
None of the tracked gdlib CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which gdlib CVE should I patch first?
CVE-2004-0990 currently ranks highest (70/100): Integer overflow in GD Graphics Library libgd 2.0.28 (libgd2), and possibly other versions, allows remote atta.