Description
The gdPngReadData function in libgd 2.0.34 allows user-assisted attackers to cause a denial of service (CPU consumption) via a crafted PNG image with truncated data, which causes an infinite loop in the png_read_info function in libpng.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libgd2 | 2.0.35.dfsg-1 | — |
| Debian 13 | libgd2 | 2.0.35.dfsg-1 | — |
| Debian 12 | libgd2 | 2.0.35.dfsg-1 | — |
| Debian 4.0 | libgd2 | 2.0.33-5.2etch1 | DSA-1613-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | gd +2 | 2.0.33-9.4.el5_1.1 | RHSA-2008:0146 |
| RHEL 5 | php +18 | 5.1.6-15.el5 | RHSA-2007:0890 |
| RHEL 4 | gd +2 | 2.0.28-5.4E.el4_6.1 | RHSA-2008:0146 |
| RHEL 4 | php +13 | 4.3.9-3.22.9 | RHSA-2007:0890 |
| RHEL 3 | php +6 | 4.3.2-43.ent | RHSA-2007:0889 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Application Stack 1 | php +18 | 5.1.6-3.el4s1.8 | RHSA-2007:0891 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | gd | 2.3.3-1.1 | openSUSE-SU-2024:10777-1 |
Advisories 6
- RHSA-2008:0146 Red Hat Security Advisory: gd security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0889 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0890 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1613-1 libgd2 - multiple vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10777-1 gd-2.3.3-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- RHSA-2007:0891 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jan 14, 2026
References
- 26231 third-party-advisory
- 36643 vdb-entry
- 1018187 vdb-entry
- 29157 third-party-advisory
- 25658 third-party-advisory
- 27110 third-party-advisory
- 25590 third-party-advisory
- 26048 third-party-advisory
- gd-gdpngreaddata-dos(34420) vdb-entry
- 25362 third-party-advisory
- OpenPKG-SA-2007.020 vendor-advisory
- 25657 third-party-advisory
- FEDORA-2007-709 vendor-advisory
- 25855 third-party-advisory
- 26967 third-party-advisory
- MDKSA-2007:122 vendor-advisory
- ADV-2007-2016 vdb-entry
- GLSA-200805-13 vendor-advisory
- GLSA-200710-02 vendor-advisory
- MDKSA-2007:123 vendor-advisory
- 24089 vdb-entry
- http://www.libgd.org/ReleaseNote020035
- GLSA-200708-05 vendor-advisory
- 30168 third-party-advisory
- MDKSA-2007:124 vendor-advisory
- ADV-2007-1904 vdb-entry
- 26930 third-party-advisory
- 35788 vdb-entry
- FEDORA-2007-2215 vendor-advisory
- ADV-2007-2336 vdb-entry
- RHSA-2007:0889 vendor-advisory
- 2007-0023 vendor-advisory
- 25353 third-party-advisory
- ADV-2007-3386 vdb-entry
- http://bugs.libgd.org/?do=details&task_id=86
- 2007-0019 vendor-advisory
- 27037 third-party-advisory
- SUSE-SR:2007:013 vendor-advisory
- 25378 third-party-advisory
- 27545 third-party-advisory
- GLSA-200711-34 vendor-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2007-449.htm
- SSA:2007-152-01 vendor-advisory
- 25646 third-party-advisory
- RHSA-2008:0146 vendor-advisory
- http://www.php.net/releases/5_2_3.php
- SSRT071447 vendor-advisory
- https://issues.rpath.com/browse/RPL-1394
- 25535 third-party-advisory
- MDKSA-2007:187 vendor-advisory
- 27102 third-party-advisory
- oval:org.mitre.oval:def:10779 vdb-entry signature
- 26895 third-party-advisory
- 25787 third-party-advisory
- 25575 third-party-advisory
- RHSA-2007:0890 vendor-advisory
- ADV-2007-1905 vdb-entry
- 26390 third-party-advisory
- RHSA-2007:0891 vendor-advisory
- USN-473-1 vendor-advisory