CVE-2017-6363
Fixed in a distro release EPSS 1%
In the GD Graphics Library (aka LibGD) through 2.2.5, there is a heap-based buffer over-read in tiffWriter in gd_tiff.c. NOTE: the vendor says "In my opinion this issue should not have a CVE, since the GD and GD2 formats are documented to be 'obsolete, and should only be used for development and testing purposes.'
Products: libgd
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.11 | gd | 2.2.5-r4 |
| Alpine 3.12 | gd | 2.3.0-r0 |
| Alpine 3.13 | gd | 2.3.0-r0 |
| Alpine 3.14 | gd | 2.3.0-r0 |
| Alpine 3.15 | gd | 2.3.0-r0 |
| Alpine 3.16 | gd | 2.3.0-r0 |
| Alpine 3.17 | gd | 2.3.0-r0 |
| Alpine 3.18 | gd | 2.3.0-r0 |
| Alpine 3.19 | gd | 2.3.0-r0 |
| Alpine 3.20 | gd | 2.3.0-r0 |
| Alpine 3.21 | gd | 2.3.0-r0 |
| Alpine 3.22 | gd | 2.3.0-r0 |
| Alpine 3.23 | gd | 2.3.0-r0 |
| Alpine 3.24 | gd | 2.3.0-r0 |
| Debian 12 | libgd2 | 2.3.0-1 |
| Debian 13 | libgd2 | 2.3.0-1 |
| Debian 14 | libgd2 | 2.3.0-1 |
| Ubuntu 18.04 LTS | libgd2 | 2.2.5-4ubuntu0.5 |
| Ubuntu 20.04 LTS | libgd2 | 2.2.5-5.2ubuntu2.1 |
| Ubuntu Pro 14.04 LTS | libgd2 | 2.1.0-3ubuntu0.11+esm2 |
| Ubuntu Pro 16.04 LTS | libgd2 | 2.1.1-4ubuntu0.16.04.12+esm1 |