CVE-2018-14553
Fixed in a distro release EPSS 3%
gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a NULL pointer dereference allowing attackers to crash an application via a specific function call sequence. Only affects PHP when linked with an external libgd (not bundled).
Products: libgd, fedoraproject fedora, canonical ubuntu_linux, debian_linux, opensuse leap
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | gd | 2.2.5-7.el8 |
| AlmaLinux 8 | gd-devel | 2.2.5-7.el8 |
| Alpine 3.10 | gd | 2.2.5-r3 |
| Alpine 3.11 | gd | 2.2.5-r3 |
| Alpine 3.12 | gd | 2.3.0-r0 |
| Alpine 3.13 | gd | 2.3.0-r0 |
| Alpine 3.14 | gd | 2.3.0-r0 |
| Alpine 3.15 | gd | 2.3.0-r0 |
| Alpine 3.16 | gd | 2.3.0-r0 |
| Alpine 3.17 | gd | 2.3.0-r0 |
| Alpine 3.18 | gd | 2.3.0-r0 |
| Alpine 3.19 | gd | 2.3.0-r0 |
| Alpine 3.20 | gd | 2.3.0-r0 |
| Alpine 3.21 | gd | 2.3.0-r0 |
| Alpine 3.22 | gd | 2.3.0-r0 |
| Alpine 3.23 | gd | 2.3.0-r0 |
| Alpine 3.24 | gd | 2.3.0-r0 |
| Alpine 3.8 | gd | 2.2.5-r3 |
| Alpine 3.9 | gd | 2.2.5-r3 |
| Debian 10 | libgd2 | 2.2.5-5.2+deb10u1 |
| Debian 12 | libgd2 | 2.3.0-1 |
| Debian 13 | libgd2 | 2.3.0-1 |
| Debian 14 | libgd2 | 2.3.0-1 |
| Debian 8 | libgd2 | 2.1.0-5+deb8u14 |
| Red Hat Enterprise Linux 8 | gd | 0:2.2.5-7.el8 |
| Red Hat Enterprise Linux 8 | gd-debuginfo | 0:2.2.5-7.el8 |
| Red Hat Enterprise Linux 8 | gd-debugsource | 0:2.2.5-7.el8 |
| Red Hat Enterprise Linux 8 | gd-devel | 0:2.2.5-7.el8 |
| Red Hat Enterprise Linux 8 | gd-progs-debuginfo | 0:2.2.5-7.el8 |
| Rocky Linux 8 | gd | 0:2.2.5-7.el8 |
| SUSE Linux Enterprise Desktop 12 SP4 | gd | 2.1.0-24.17.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP1 | gd | 2.2.5-4.14.1 |
| SUSE Linux Enterprise Module for Desktop Applications 15 SP1 | gd | 2.2.5-4.14.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP1 | gd | 2.2.5-4.14.1 |
| SUSE Linux Enterprise Server 12 SP4 | gd | 2.1.0-24.17.1 |
| SUSE Linux Enterprise Server 12 SP5 | gd | 2.1.0-24.17.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | gd | 2.1.0-24.17.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | gd | 2.1.0-24.17.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP4 | gd | 2.1.0-24.17.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | gd | 2.1.0-24.17.1 |
| SUSE Linux Enterprise Workstation Extension 12 SP4 | gd | 2.1.0-24.17.1 |
| SUSE Linux Enterprise Workstation Extension 12 SP5 | gd | 2.1.0-24.17.1 |
| Ubuntu 16.04 LTS | libgd2 | 2.1.1-4ubuntu0.16.04.12 |
| Ubuntu 18.04 LTS | libgd2 | 2.2.5-4ubuntu0.4 |
| Ubuntu 20.04 LTS | doxygen | no fix |
| Ubuntu 22.04 LTS | doxygen | no fix |
| Ubuntu 24.04 LTS | doxygen | no fix |
| Ubuntu 25.10 | doxygen | no fix |
| Ubuntu 26.04 LTS | doxygen | no fix |
| Ubuntu 26.10 | doxygen | no fix |
| Ubuntu Pro 14.04 LTS | libgd2 | 2.1.0-3ubuntu0.11+esm1 |
| openSUSE Leap 15.1 | gd | 2.2.5-lp151.6.6.1 |
| openSUSE Tumbleweed | gd | 2.3.3-1.1 |