CVE-2014-2497
CVE-2014-2497
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The gdImageCreateFromXpm function in gdxpm.c in libgd, as used in PHP 5.4.26 and earlier, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted color table in an XPM file.
EPSS 20.3% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
libgd2 Debian:12
- Affected ranges
- ECOSYSTEM: < 2.1.0-4
Update to 2.1.0-4
libgd2 Debian:13
- Affected ranges
- ECOSYSTEM: < 2.1.0-4
Update to 2.1.0-4
libgd2 Debian:14
- Affected ranges
- ECOSYSTEM: < 2.1.0-4
Update to 2.1.0-4
libgd2 Ubuntu:14.04:LTS
- Versions
- 2.1.0-2
- 2.1.0-3
- Affected ranges
- ECOSYSTEM: < 2.1.0-3ubuntu0.1
Update to 2.1.0-3ubuntu0.1
Original sources
- http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00001.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:153
- http://secunia.com/advisories/59418
- https://support.apple.com/HT204659
- http://secunia.com/advisories/59496
- http://rhn.redhat.com/errata/RHSA-2014-1766.html
- http://secunia.com/advisories/59652
- https://bugzilla.redhat.com/show_bug.cgi?id=1076676
- http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00002.html
- http://www.debian.org/security/2015/dsa-3215
- http://secunia.com/advisories/59061
- https://security.gentoo.org/glsa/201607-04
- http://rhn.redhat.com/errata/RHSA-2014-1326.html
- http://advisories.mageia.org/MGASA-2014-0288.html
- http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html
- http://www.securityfocus.com/bid/66233
- http://www.ubuntu.com/usn/USN-2987-1
- http://rhn.redhat.com/errata/RHSA-2014-1327.html
- http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
- http://rhn.redhat.com/errata/RHSA-2014-1765.html
- https://bugs.php.net/bug.php?id=66901
- https://nvd.nist.gov/vuln/detail/CVE-2014-2497