This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2019-6977 →

DEBIAN-CVE-2019-6977

gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch function in PHP before 5.6.40, 7.x...

Original description

The description as published by the source.

gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch function in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1, has a heap-based buffer overflow. This can be exploited by an attacker who is able to trigger imagecolormatch calls with crafted image data.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 libgd2

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-5.1"}]}]

Debian:13 libgd2

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-5.1"}]}]

Debian:14 libgd2

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-5.1"}]}]

References

advisory security-tracker.debian.org