Skip to content
OpenAdvisories
Low USN-4316-1 2 CVEs

libgd2 vulnerabilities

Published Apr 2, 2020 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that GD Graphics Library incorrectly handled cloning an
image. An attacker could possibly use this issue to cause GD Graphics Library
to crash, resulting in a denial of service. (CVE-2018-14553)

It was discovered that GD Graphics Library incorrectly handled loading images
from X bitmap format files. An attacker could possibly use this issue to cause
GD Graphics Library to crash, resulting in a denial of service, or to disclose
contents of the stack that has been left there by previous code. This issue
only affected Ubuntu 18.04 LTS and Ubuntu 16.04 LTS. (CVE-2019-11038)

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 16.04 LTS 16.04:LTS libgd2 2.1.1-4ubuntu0.16.04.12
Ubuntu · 18.04 LTS 18.04:LTS libgd2 2.2.5-4ubuntu0.4

Vulnerabilities 2

  • Low 3.1
    CVE-2019-11038

    Uninitialized read in gdImageCreateFromXbm

    When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the functi…

    PHP Group PHP php7 libgd2 Debian Ubuntu Alpine
  • Unscored —
    CVE-2018-14553

    gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a NULL pointer dereference allowing attackers to crash an app…

    libgd2 libgd2 gd doxygen Debian Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2018-14553
  • report
    https://ubuntu.com/security/CVE-2019-11038