bugtraq - [SECURITY] [DSA 3630-1] libgd2 security update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <E1bS8Zf-0005ZW-Pv@master.debian.org>
Date: Tue, 26 Jul 2016 20:03:31 +0000
From: Salvatore Bonaccorso <carnil@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 3630-1] libgd2 security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3630-1                   security@...ian.org
https://www.debian.org/security/                     Salvatore Bonaccorso
July 26, 2016                         https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : libgd2
CVE ID         : CVE-2016-6207

Secunia Research at Flexera Software discovered an integer overflow
vulnerability within the _gdContributionsAlloc() function in libgd2, a
library for programmatic graphics creation and manipulation. A remote
attacker can take advantage of this flaw to cause a denial-of-service
against an application using the libgd2 library.

For the stable distribution (jessie), this problem has been fixed in
version 2.1.0-5+deb8u6.

For the unstable distribution (sid), this problem has been fixed in
version 2.2.2-43-g22cba39-1.

We recommend that you upgrade your libgd2 packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@...ts.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJXl76SAAoJEAVMuPMTQ89ER7EP/jRZHZusnIg7qYcZ0hGfMNuC
9OUcbl1A4/F8fwJMim+HaUj5AcGDSCc8gLOPJKKZZexams504qgKgqbRWnJtZQhr
OHJ5gSJnYXOYwg08ujbFKR+e0DsLDWods9DO9phXq+rCnueOlg+lqX+uTwoDL7nR
7kcIjnX+WL1q3+g9TtxKYWf+t32kD04bmkOxL0Oq2ZBLDFJQL05jFyZEtivSEX9v
OMWalLRjUEEFP/KqD4Q/6FksH5zT3HiUQ4+MxjnbqrYyhs5iyswPFy248zJRkD80
7taRPvFEesH/1RZ9B113vLS1dZ2Lr8/eqlswaZtbUfBzRCDaeNVyhxkcUIHLzlc0
nmaRTNcVfTHaz0Y3iG1sQ1pk3yxWS30dLT4hzNf2sNMa1II2PQBxSysUypKruEqG
gePrO2N80RMOKq1FWSdfjollQpiNy2ofGANa1gqCTcWvPCO+Ro8oj5Zl+TGa8s5s
Yfus+l2rzV37sGpydLY3mtVZnxjCStJVlI22Xw9ek+YdACu6LSqF/JIJJKOIu9Zf
nt49DSKx2uRtRL6nQ+1CkJuhlv79GDZTLJyCE4WfK7ahnk6TJWblwzAG1GWNQF2T
OX2W/61vz413bzNsiP2oYAcMb6Rjr7L0AB50zF7agdKGCUiAP4IlMX3cxVgk4Q8r
DQXRVQNcycb5Kkx3w/R4
=D4CK
-----END PGP SIGNATURE-----