oss-sec mailing list archives
Re: Re: CVE Request: libgd: Invalid color index is not properly handled leading to denial of service (crash)
From: Salvatore Bonaccorso <carnil () debian org>
Date: Thu, 30 Jun 2016 14:14:25 +0200
Hi, On Wed, Jun 29, 2016 at 09:27:58PM -0400, cve-assign () mitre org wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256There is currently PHP upstream bug which is still marked as private: https://bugs.php.net/bug.php?id=72494 But the libgd project references the following set of commits to this bug report: https://github.com/libgd/libgd/compare/3fe0a71...6ff72ae indicating that libgd does not properly handle invalid color index, which could lead to a denial of service against applications using the libgd library (in particular thus PHP).https://github.com/libgd/libgd/commit/1ccfe21e14c4d18336f9da8515cd17db88c3de61 gd_crop.c gdImageCropThreshold + if (color < 0 || (!gdImageTrueColor(im) && color >= gdImageColorsTotal(im))) { + return NULL; + }https://github.com/libgd/libgd/commit/6ff72ae40c7c20ece939afb362d98cc37f4a1c96 tests/gdimagecrop/php_bug_72494.c im = gdImageCreate(50, 50); gdImageCropThreshold(im, 1337, 0); gdImageDestroy(im);Use CVE-2016-6128.
Thanks for the CVE assignment. Just for the record, my above commit range stated should have better been written as https://github.com/libgd/libgd/compare/3fe0a7128bac5000fdcfab888bd2a75ec0c9447d...fd623025505e87bba7ec8555eeb72dae4fb0afd including https://github.com/libgd/libgd/commit/a0f9f8f7bd0d3a6c6afd6d180b8e75d93aadddfa Regards, Salvatore
Current thread:
- CVE Request: libgd: Invalid color index is not properly handled leading to denial of service (crash) Salvatore Bonaccorso (Jun 29)
- Re: CVE Request: libgd: Invalid color index is not properly handled leading to denial of service (crash) cve-assign (Jun 29)
- Re: Re: CVE Request: libgd: Invalid color index is not properly handled leading to denial of service (crash) Salvatore Bonaccorso (Jun 30)
- Re: CVE Request: libgd: Invalid color index is not properly handled leading to denial of service (crash) cve-assign (Jun 29)