[Buildroot] [git commit] package/gd: fix CVE-2018-14553 and CVE-2019-6977
Peter Korsgaard
peter at korsgaard.com
Tue Aug 18 15:35:23 UTC 2020
>>>>> "Peter" == Peter Korsgaard <peter at korsgaard.com> writes:
> commit: https://git.buildroot.net/buildroot/commit/?id=6fa1a32dac3cb4ee03fd11bb965cd4b57d14e86a
> branch: https://git.buildroot.net/buildroot/commit/?id=refs/heads/master
> - Fix CVE-2018-14553 : gdImageClone in gd.c in libgd 2.1.0-rc2 through
> 2.2.5 has a NULL pointer dereference allowing attackers to crash an
> application via a specific function call sequence.
> - Fix CVE-2019-6977: gdImageColorMatch in gd_color_match.c in the GD
> Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch
> function in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14,
> and 7.3.x before 7.3.1, has a heap-based buffer overflow. This can be
> exploited by an attacker who is able to trigger imagecolormatch calls
> with crafted image data.
> Signed-off-by: Fabrice Fontaine <fontaine.fabrice at gmail.com>
> Signed-off-by: Peter Korsgaard <peter at korsgaard.com>
Committed to 2020.02.x and 2020.05.x, thanks.
--
Bye, Peter Korsgaard
More information about the buildroot
mailing list