oss-security - CVE Request: libgd: Invalid color index is not properly handled leading to denial of service (crash)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20160629194243.GA12097@eldamar.local>
Date: Wed, 29 Jun 2016 21:42:44 +0200
From: Salvatore Bonaccorso <carnil@...ian.org>
To: OSS Security Mailinglist <oss-security@...ts.openwall.com>
Subject: CVE Request: libgd: Invalid color index is not properly handled
 leading to denial of service (crash)

Hi

There is currently PHP upstream bug which is still marked as private:

https://bugs.php.net/bug.php?id=72494

But the libgd project references the following set of commits to this
bug report:

https://github.com/libgd/libgd/compare/3fe0a71...6ff72ae

indicating that libgd does not properly handle invalid color index,
which could lead to a denial of service against applications using the
libgd library (in particular thus PHP).

Could you please assign a CVE for this issue (in case it was not yet
requested by other channels?)

Regards,
Salvatore

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.