Race Condition Affecting libgd2 package, versions <2.0.35.dfsg-1


Severity

Recommended
low

Based on Debian security rating.

Threat Intelligence

EPSS
17.67% (97th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Race Condition vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-DEBIAN10-LIBGD2-383254
  • published28 Jun 2007
  • disclosed28 Jun 2007

Introduced: 28 Jun 2007

CVE-2007-3478  (opens in a new tab)
CWE-362  (opens in a new tab)

How to fix?

Upgrade Debian:10 libgd2 to version 2.0.35.dfsg-1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgd2 package and not the libgd2 package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

Race condition in gdImageStringFTEx (gdft_draw_bitmap) in gdft.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors, possibly involving truetype font (TTF) support.

References

CVSS Scores

version 3.1