FreeBSD : gd -- multiple vulnerabilities (6e099997-25d8-11dc-878b-000c29c5647f)

NASLDB: FreeBSD : gd -- multiple vulnerabilities (6e099997-25d8-11dc-878b-000c29c5647f)

General

ID: 25633
Name: FreeBSD : gd — multiple vulnerabilities (6e099997-25d8-11dc-878b-000c29c5647f)

Summary: Checks for updated package in pkg_info output

Credits: Tenable Network Security, Inc.

Classification

Risk: –

CVSS: –
CVSS Base Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSS Temporal Vector: –

Port: 0
Family: FreeBSD Local Security Checks
Type: Local

Description

gd had been reported vulnerable to several vulnerabilities :

– CVE-2007-3472: Integer overflow in gdImageCreateTrueColor function
in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted
remote attackers has unspecified attack vectors and impact.

– CVE-2007-3473: The gdImageCreateXbm function in the GD Graphics
Library (libgd) before 2.0.35 allows user-assisted remote attackers to
cause a denial of service (crash) via unspecified vectors involving a
gdImageCreate failure.

– CVE-2007-3474: Multiple unspecified vulnerabilities in the GIF
reader in the GD Graphics Library (libgd) before 2.0.35 allow
user-assisted remote attackers to have unspecified attack vectors and
impact.

– CVE-2007-3475: The GD Graphics Library (libgd) before 2.0.35 allows
user-assisted remote attackers to cause a denial of service (crash)
via a GIF image that has no global color map.

– CVE-2007-3476: Array index error in gd_gif_in.c in the GD Graphics
Library (libgd) before 2.0.35 allows user-assisted remote attackers to
cause a denial of service (crash and heap corruption) via large color
index values in crafted image data, which results in a segmentation
fault.

– CVE-2007-3477: The (a) imagearc and (b) imagefilledarc functions in
GD Graphics Library (libgd) before 2.0.35 allows attackers to cause a
denial of service (CPU consumption) via a large (1) start or (2) end
angle degree value.

– CVE-2007-3478: Race condition in gdImageStringFTEx
(gdft_draw_bitmap) in gdft.c in the GD Graphics Library (libgd) before
2.0.35 allows user-assisted remote attackers to cause a denial of
service (crash) via unspecified vectors, possibly involving truetype
font (TTF) support.

Exploiting

Exploit Available: –
Exploitability Ease: –

Sources

CVE: CVE-2007-3472
OSVDB: –
Bugtraq: –
scipID: –

Timeline

Vulnerability Disclosure: 2007/06/21
Patch Release: 2007/06/29
Plugin Release: 2007/07/01

Plugin

Version: 1.11
Filename: freebsd_pkg_6e09999725d811dc878b000c29c5647f.nasl
Filesize: 6815 bytes
MD5 Hash: 89bcfdcb9a5148242a90a7261f5c39c4

Identification: Host/local_checks_enabled
Require Keys: Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info
Dependencies: "ssh_get_info.nasl"

Latest Plugins

Latest Plugins

scip AG