Security update for gd SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:0594-1 Final 1 1 2020-03-05T14:16:54Z current 2020-03-05T14:16:54Z 2020-03-05T14:16:54Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for gd This update for gd fixes the following issues: Security issue fixed: - CVE-2018-14553: Fixed a null pointer dereference in gdImageClone (bsc#1165471). - CVE-2019-11038: Fixed a information disclosure in gdImageCreateFromXbm() (bsc#1140120). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES15-SAP-Azure-2020-594,Image SLES15-SAP-Azure-BYOS-2020-594,Image SLES15-SAP-Azure-LI-BYOS-Production-2020-594,Image SLES15-SAP-Azure-VLI-BYOS-Production-2020-594,Image SLES15-SAP-EC2-HVM-2020-594,Image SLES15-SAP-EC2-HVM-BYOS-2020-594,Image SLES15-SAP-GCE-2020-594,Image SLES15-SAP-GCE-BYOS-2020-594,Image SLES15-SAP-OCI-BYOS-2020-594,Image SLES15-SP1-CAP-Deployment-BYOS-EC2-HVM-2020-594,Image SLES15-SP1-CAP-Deployment-BYOS-GCE-2020-594,Image SLES15-SP1-SAP-Azure-2020-594,Image SLES15-SP1-SAP-Azure-BYOS-2020-594,Image SLES15-SP1-SAP-Azure-LI-BYOS-Production-2020-594,Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production-2020-594,Image SLES15-SP1-SAP-EC2-HVM-2020-594,Image SLES15-SP1-SAP-EC2-HVM-BYOS-2020-594,Image SLES15-SP1-SAP-GCE-2020-594,Image SLES15-SP1-SAP-GCE-BYOS-2020-594,Image SLES15-SP1-SAP-OCI-BYOS-2020-594,SUSE-2020-594,SUSE-SLE-Module-Basesystem-15-SP1-2020-594,SUSE-SLE-Module-Desktop-Applications-15-SP1-2020-594,SUSE-SLE-Module-Development-Tools-OBS-15-SP1-2020-594 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20200594-1/ Link for SUSE-SU-2020:0594-1 https://lists.suse.com/pipermail/sle-security-updates/2020-March/006579.html E-Mail link for SUSE-SU-2020:0594-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1140120 SUSE Bug 1140120 https://bugzilla.suse.com/1165471 SUSE Bug 1165471 https://www.suse.com/security/cve/CVE-2018-14553/ SUSE CVE CVE-2018-14553 page https://www.suse.com/security/cve/CVE-2019-11038/ SUSE CVE CVE-2019-11038 page Image SLES15-SAP-Azure Image SLES15-SAP-Azure-BYOS Image SLES15-SAP-Azure-LI-BYOS-Production Image SLES15-SAP-Azure-VLI-BYOS-Production Image SLES15-SAP-EC2-HVM Image SLES15-SAP-EC2-HVM-BYOS Image SLES15-SAP-GCE Image SLES15-SAP-GCE-BYOS Image SLES15-SAP-OCI-BYOS Image SLES15-SP1-CAP-Deployment-BYOS-EC2-HVM Image SLES15-SP1-CAP-Deployment-BYOS-GCE Image SLES15-SP1-SAP-Azure Image SLES15-SP1-SAP-Azure-BYOS Image SLES15-SP1-SAP-Azure-LI-BYOS-Production Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production Image SLES15-SP1-SAP-EC2-HVM Image SLES15-SP1-SAP-EC2-HVM-BYOS Image SLES15-SP1-SAP-GCE Image SLES15-SP1-SAP-GCE-BYOS Image SLES15-SP1-SAP-OCI-BYOS SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1 libgd3-2.2.5-4.14.1 gd-2.2.5-4.14.1 gd-devel-2.2.5-4.14.1 libgd3-32bit-2.2.5-4.14.1 libgd3-64bit-2.2.5-4.14.1 libgd3-2.2.5-4.14.1 as a component of Image SLES15-SAP-Azure libgd3-2.2.5-4.14.1 as a component of Image SLES15-SAP-Azure-BYOS libgd3-2.2.5-4.14.1 as a component of Image SLES15-SAP-Azure-LI-BYOS-Production libgd3-2.2.5-4.14.1 as a component of Image SLES15-SAP-Azure-VLI-BYOS-Production libgd3-2.2.5-4.14.1 as a component of Image SLES15-SAP-EC2-HVM libgd3-2.2.5-4.14.1 as a component of Image SLES15-SAP-EC2-HVM-BYOS libgd3-2.2.5-4.14.1 as a component of Image SLES15-SAP-GCE libgd3-2.2.5-4.14.1 as a component of Image SLES15-SAP-GCE-BYOS libgd3-2.2.5-4.14.1 as a component of Image SLES15-SAP-OCI-BYOS libgd3-2.2.5-4.14.1 as a component of Image SLES15-SP1-CAP-Deployment-BYOS-EC2-HVM libgd3-2.2.5-4.14.1 as a component of Image SLES15-SP1-CAP-Deployment-BYOS-GCE libgd3-2.2.5-4.14.1 as a component of Image SLES15-SP1-SAP-Azure libgd3-2.2.5-4.14.1 as a component of Image SLES15-SP1-SAP-Azure-BYOS libgd3-2.2.5-4.14.1 as a component of Image SLES15-SP1-SAP-Azure-LI-BYOS-Production libgd3-2.2.5-4.14.1 as a component of Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production libgd3-2.2.5-4.14.1 as a component of Image SLES15-SP1-SAP-EC2-HVM libgd3-2.2.5-4.14.1 as a component of Image SLES15-SP1-SAP-EC2-HVM-BYOS libgd3-2.2.5-4.14.1 as a component of Image SLES15-SP1-SAP-GCE libgd3-2.2.5-4.14.1 as a component of Image SLES15-SP1-SAP-GCE-BYOS libgd3-2.2.5-4.14.1 as a component of Image SLES15-SP1-SAP-OCI-BYOS libgd3-2.2.5-4.14.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP1 gd-2.2.5-4.14.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1 gd-devel-2.2.5-4.14.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1 gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a NULL pointer dereference allowing attackers to crash an application via a specific function call sequence. Only affects PHP when linked with an external libgd (not bundled). CVE-2018-14553 Image SLES15-SAP-Azure-BYOS:libgd3-2.2.5-4.14.1 Image SLES15-SAP-Azure-LI-BYOS-Production:libgd3-2.2.5-4.14.1 Image SLES15-SAP-Azure-VLI-BYOS-Production:libgd3-2.2.5-4.14.1 Image SLES15-SAP-Azure:libgd3-2.2.5-4.14.1 Image SLES15-SAP-EC2-HVM-BYOS:libgd3-2.2.5-4.14.1 Image SLES15-SAP-EC2-HVM:libgd3-2.2.5-4.14.1 Image SLES15-SAP-GCE-BYOS:libgd3-2.2.5-4.14.1 Image SLES15-SAP-GCE:libgd3-2.2.5-4.14.1 Image SLES15-SAP-OCI-BYOS:libgd3-2.2.5-4.14.1 Image SLES15-SP1-CAP-Deployment-BYOS-EC2-HVM:libgd3-2.2.5-4.14.1 Image SLES15-SP1-CAP-Deployment-BYOS-GCE:libgd3-2.2.5-4.14.1 Image SLES15-SP1-SAP-Azure-BYOS:libgd3-2.2.5-4.14.1 Image SLES15-SP1-SAP-Azure-LI-BYOS-Production:libgd3-2.2.5-4.14.1 Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production:libgd3-2.2.5-4.14.1 Image SLES15-SP1-SAP-Azure:libgd3-2.2.5-4.14.1 Image SLES15-SP1-SAP-EC2-HVM-BYOS:libgd3-2.2.5-4.14.1 Image SLES15-SP1-SAP-EC2-HVM:libgd3-2.2.5-4.14.1 Image SLES15-SP1-SAP-GCE-BYOS:libgd3-2.2.5-4.14.1 Image SLES15-SP1-SAP-GCE:libgd3-2.2.5-4.14.1 Image SLES15-SP1-SAP-OCI-BYOS:libgd3-2.2.5-4.14.1 SUSE Linux Enterprise Module for Basesystem 15 SP1:libgd3-2.2.5-4.14.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:gd-2.2.5-4.14.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:gd-devel-2.2.5-4.14.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20200594-1/ https://www.suse.com/security/cve/CVE-2018-14553.html CVE-2018-14553 https://bugzilla.suse.com/1165471 SUSE Bug 1165471 When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been left there by previous code. CVE-2019-11038 Image SLES15-SAP-Azure-BYOS:libgd3-2.2.5-4.14.1 Image SLES15-SAP-Azure-LI-BYOS-Production:libgd3-2.2.5-4.14.1 Image SLES15-SAP-Azure-VLI-BYOS-Production:libgd3-2.2.5-4.14.1 Image SLES15-SAP-Azure:libgd3-2.2.5-4.14.1 Image SLES15-SAP-EC2-HVM-BYOS:libgd3-2.2.5-4.14.1 Image SLES15-SAP-EC2-HVM:libgd3-2.2.5-4.14.1 Image SLES15-SAP-GCE-BYOS:libgd3-2.2.5-4.14.1 Image SLES15-SAP-GCE:libgd3-2.2.5-4.14.1 Image SLES15-SAP-OCI-BYOS:libgd3-2.2.5-4.14.1 Image SLES15-SP1-CAP-Deployment-BYOS-EC2-HVM:libgd3-2.2.5-4.14.1 Image SLES15-SP1-CAP-Deployment-BYOS-GCE:libgd3-2.2.5-4.14.1 Image SLES15-SP1-SAP-Azure-BYOS:libgd3-2.2.5-4.14.1 Image SLES15-SP1-SAP-Azure-LI-BYOS-Production:libgd3-2.2.5-4.14.1 Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production:libgd3-2.2.5-4.14.1 Image SLES15-SP1-SAP-Azure:libgd3-2.2.5-4.14.1 Image SLES15-SP1-SAP-EC2-HVM-BYOS:libgd3-2.2.5-4.14.1 Image SLES15-SP1-SAP-EC2-HVM:libgd3-2.2.5-4.14.1 Image SLES15-SP1-SAP-GCE-BYOS:libgd3-2.2.5-4.14.1 Image SLES15-SP1-SAP-GCE:libgd3-2.2.5-4.14.1 Image SLES15-SP1-SAP-OCI-BYOS:libgd3-2.2.5-4.14.1 SUSE Linux Enterprise Module for Basesystem 15 SP1:libgd3-2.2.5-4.14.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:gd-2.2.5-4.14.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:gd-devel-2.2.5-4.14.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20200594-1/ https://www.suse.com/security/cve/CVE-2019-11038.html CVE-2019-11038 https://bugzilla.suse.com/1140118 SUSE Bug 1140118 https://bugzilla.suse.com/1140120 SUSE Bug 1140120