CVE-2017-6363: High severity libgd vulnerability
DISPUTED In the GD Graphics Library (aka LibGD) through 2.2.5, there is a heap-based buffer over-read in tiffWriter in gdtiff.c. NOTE: the vendor says "In my opinion this issue should not have a CVE, since the GD and GD2 formats are documented to be 'obsolete, and should only be used for development and testing purposes.'"
Affected Software
Event History
Frequently Asked Questions
What is CVE-2017-6363?
CVE-2017-6363 is a vulnerability in the GD Graphics Library (LibGD) that allows a heap-based buffer over-read in tiffWriter.
What is the severity of CVE-2017-6363?
The severity of CVE-2017-6363 is high, with a CVSS score of 8.1.
How does CVE-2017-6363 impact LibGD?
CVE-2017-6363 allows an attacker to perform a heap-based buffer over-read in tiffWriter, potentially leading to information disclosure or denial of service.
Is there a fix available for CVE-2017-6363 in LibGD?
Yes, the vendor has released a fix for CVE-2017-6363 in LibGD. It is recommended to update to version 2.2.6 or later.
Where can I find more information about CVE-2017-6363?
You can find more information about CVE-2017-6363 on the GitHub issue page: https://github.com/libgd/libgd/issues/383