CVE-2021-40145
Fixed in a distro release EPSS 2%
gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has a double free. NOTE: the vendor's position is "The GD2 image format is a proprietary image format of libgd. It has to be regarded as being obsolete, and should only be used for development and testing purposes.
Products: libgd
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.11 | gd | 2.2.5-r4 |
| Alpine 3.12 | gd | 2.3.0-r1 |
| Alpine 3.13 | gd | 2.3.0-r1 |
| Alpine 3.14 | gd | 2.3.0-r1 |
| Alpine 3.15 | gd | 2.3.0-r1 |
| Alpine 3.16 | gd | 2.3.0-r1 |
| Alpine 3.17 | gd | 2.3.0-r1 |
| Alpine 3.18 | gd | 2.3.0-r1 |
| Alpine 3.19 | gd | 2.3.0-r1 |
| Alpine 3.20 | gd | 2.3.0-r1 |
| Alpine 3.21 | gd | 2.3.0-r1 |
| Alpine 3.22 | gd | 2.3.0-r1 |
| Alpine 3.23 | gd | 2.3.0-r1 |
| Alpine 3.24 | gd | 2.3.0-r1 |
| Amazon Linux 2 | gd | 2.0.35-27.amzn2.0.1 |
| Amazon Linux 2 | gd-devel | 2.0.35-27.amzn2.0.1 |
| Amazon Linux 2 | gd-progs | 2.0.35-27.amzn2.0.1 |
| Arch Linux | gd | 2.3.3-1 |
| Debian 11 | libgd2 | 2.3.0-2+deb11u1 |
| Debian 12 | libgd2 | 2.3.3-1 |
| Debian 13 | libgd2 | 2.3.3-1 |
| Debian 14 | libgd2 | 2.3.3-1 |
| Ubuntu 18.04 LTS | libgd2 | 2.2.5-4ubuntu0.5 |
| Ubuntu 20.04 LTS | libgd2 | 2.2.5-5.2ubuntu2.1 |
| Ubuntu 22.04 LTS | libgd2 | 2.3.0-2ubuntu1 |
| Ubuntu Pro 14.04 LTS | libgd2 | 2.1.0-3ubuntu0.11+esm2 |
| Ubuntu Pro 16.04 LTS | libgd2 | 2.1.1-4ubuntu0.16.04.12+esm1 |