==========================================================================
Ubuntu Security Notice USN-7112-1
November 15, 2024

libgd2 vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- - Ubuntu 22.04 LTS
- - Ubuntu 20.04 LTS
- - Ubuntu 18.04 LTS
- - Ubuntu 16.04 LTS

Summary:

GD Graphics Library could be made to crash if it opened a specially
crafted file.

Software Description:
- - libgd2: GD Graphics Library

Details:

It was discovered that the GD Graphics Library did not perform proper
bounds checking while handling BMP and WebP files. If a user were tricked
into opening a specially crafted file, an attacker could possibly use
this issue to cause a denial of service (application crash).

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS
libgd-dev 2.3.0-2ubuntu2.3
libgd-tools 2.3.0-2ubuntu2.3
libgd3 2.3.0-2ubuntu2.3

Ubuntu 20.04 LTS
libgd-dev 2.2.5-5.2ubuntu2.4
libgd-tools 2.2.5-5.2ubuntu2.4
libgd3 2.2.5-5.2ubuntu2.4

Ubuntu 18.04 LTS
libgd-dev 2.2.5-4ubuntu0.5+esm3
Available with Ubuntu Pro
libgd-tools 2.2.5-4ubuntu0.5+esm3
Available with Ubuntu Pro
libgd3 2.2.5-4ubuntu0.5+esm3
Available with Ubuntu Pro

Ubuntu 16.04 LTS
libgd-dev 2.1.1-4ubuntu0.16.04.12+esm4
Available with Ubuntu Pro
libgd-tools 2.1.1-4ubuntu0.16.04.12+esm4
Available with Ubuntu Pro
libgd3 2.1.1-4ubuntu0.16.04.12+esm4
Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-7112-1
CVE-2021-40812

Package Information:
https://launchpad.net/ubuntu/+source/libgd2/2.3.0-2ubuntu2.3
https://launchpad.net/ubuntu/+source/libgd2/2.2.5-5.2ubuntu2.4
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEKl1CaPno2Qy4/AU8lFzKVeTWQe4FAmc2q8gACgkQlFzKVeTW
Qe5TEw/8D7vt83fOu551WA61LxJDVejpdMvP84dKC5SbgngZ8C71FRjaiL2RNhXM
z1r4kU3MYQ64WYcjioCInZVljdxLgwTyPbJ08qIhmupCsPXv/w6Bo1DW6oJn9Pgh
2XGA9wGqFpGnqpUYbJHViSMr9c09TgBpDxTmMUH+iJmxKfYyGC85wD+E9Gta7bT/
jHllFz4hnBCZNDHpDyEB5g9utSszlc2+IkrzOe6Ln1kZbsBYpMU0ww8aoFQZM/lM
/hQn43EYxf19yJxgI1QF/eI7ZVcUDrbdTbuxQXe9z8q3qqaybEl3X64N5zknYAII
+fE0DO3WBDhEu5jDFXh38jX3GIO6qBMQH6WqhTsJmgpAGD6lJSKT3RxoXF23eDpB
CPXUqojiL8s2bEW5jnZ3iBw47gkWGKnS235XEvNMoSJV+s6ka3qYkbdjvL4AN8Hb
42SJM4O+UKMmSiA3ouR3TIrc9MyZ0t+hdzrb6PaDpnCvKcY+O8+sCK0ksmJqmYvp
WqZ+HyzFZbbM8t8JT+U5M6LZRWvkv2jGsMg+MPL1ZFeil0m0b6sPhSQp0tbvtGFO
YSxQ/sVKB8aVFjZ3MajxQOtIbTJ3TEgOfjAi8S1nvVQHKO1Me+26X5P7KYsJHJKi
sUPLU8FqoSmlGK3m6pMM6Y3H9hSYpFoxKu/N8vZpksjXO1hYokc=
=TfRa
-----END PGP SIGNATURE-----