Security update for gd SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:0623-1 Final 1 1 2020-03-09T15:17:43Z current 2020-03-09T15:17:43Z 2020-03-09T15:17:43Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for gd This update for gd fixes the following issues: - CVE-2017-7890: Fixed a buffer over-read into uninitialized memory (bsc#1050241). - CVE-2018-14553: Fixed a null pointer dereference in gdImageClone() (bsc#1165471). - CVE-2019-11038: Fixed a information disclosure in gdImageCreateFromXbm() (bsc#1140120). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container caasp/v4/nginx-ingress-controller:beta1-2020-623,Image SLES12-SP4-SAP-Azure-2020-623,Image SLES12-SP4-SAP-Azure-BYOS-2020-623,Image SLES12-SP4-SAP-Azure-LI-BYOS-Production-2020-623,Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production-2020-623,Image SLES12-SP4-SAP-EC2-HVM-2020-623,Image SLES12-SP4-SAP-EC2-HVM-BYOS-2020-623,Image SLES12-SP4-SAP-GCE-2020-623,Image SLES12-SP4-SAP-GCE-BYOS-2020-623,Image SLES12-SP4-SAP-OCI-BYOS-2020-623,Image SLES12-SP5-Azure-SAP-BYOS-2020-623,Image SLES12-SP5-Azure-SAP-On-Demand-2020-623,Image SLES12-SP5-EC2-SAP-BYOS-2020-623,Image SLES12-SP5-EC2-SAP-On-Demand-2020-623,Image SLES12-SP5-GCE-SAP-BYOS-2020-623,Image SLES12-SP5-GCE-SAP-On-Demand-2020-623,Image SLES12-SP5-OCI-BYOS-SAP-BYOS-2020-623,Image SLES12-SP5-SAP-Azure-LI-BYOS-Production-2020-623,Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production-2020-623,SUSE-2020-623,SUSE-SLE-DESKTOP-12-SP4-2020-623,SUSE-SLE-SDK-12-SP4-2020-623,SUSE-SLE-SDK-12-SP5-2020-623,SUSE-SLE-SERVER-12-SP4-2020-623,SUSE-SLE-SERVER-12-SP5-2020-623,SUSE-SLE-WE-12-SP4-2020-623,SUSE-SLE-WE-12-SP5-2020-623 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20200623-1/ Link for SUSE-SU-2020:0623-1 https://lists.suse.com/pipermail/sle-security-updates/2020-March/006588.html E-Mail link for SUSE-SU-2020:0623-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1050241 SUSE Bug 1050241 https://bugzilla.suse.com/1140120 SUSE Bug 1140120 https://bugzilla.suse.com/1165471 SUSE Bug 1165471 https://www.suse.com/security/cve/CVE-2017-7890/ SUSE CVE CVE-2017-7890 page https://www.suse.com/security/cve/CVE-2018-14553/ SUSE CVE CVE-2018-14553 page https://www.suse.com/security/cve/CVE-2019-11038/ SUSE CVE CVE-2019-11038 page Container caasp/v4/nginx-ingress-controller:beta1 Image SLES12-SP4-SAP-Azure Image SLES12-SP4-SAP-Azure-BYOS Image SLES12-SP4-SAP-Azure-LI-BYOS-Production Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production Image SLES12-SP4-SAP-EC2-HVM Image SLES12-SP4-SAP-EC2-HVM-BYOS Image SLES12-SP4-SAP-GCE Image SLES12-SP4-SAP-GCE-BYOS Image SLES12-SP4-SAP-OCI-BYOS Image SLES12-SP5-Azure-SAP-BYOS Image SLES12-SP5-Azure-SAP-On-Demand Image SLES12-SP5-EC2-SAP-BYOS Image SLES12-SP5-EC2-SAP-On-Demand Image SLES12-SP5-GCE-SAP-BYOS Image SLES12-SP5-GCE-SAP-On-Demand Image SLES12-SP5-OCI-BYOS-SAP-BYOS Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production SUSE Linux Enterprise Desktop 12 SP4 SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP4 SUSE Linux Enterprise Software Development Kit 12 SP5 SUSE Linux Enterprise Workstation Extension 12 SP4 SUSE Linux Enterprise Workstation Extension 12 SP5 gd-2.1.0-24.17.1 gd-32bit-2.1.0-24.17.1 gd-64bit-2.1.0-24.17.1 gd-devel-2.1.0-24.17.1 gd-2.1.0-24.17.1 as a component of Container caasp/v4/nginx-ingress-controller:beta1 gd-2.1.0-24.17.1 as a component of Image SLES12-SP4-SAP-Azure gd-2.1.0-24.17.1 as a component of Image SLES12-SP4-SAP-Azure-BYOS gd-2.1.0-24.17.1 as a component of Image SLES12-SP4-SAP-Azure-LI-BYOS-Production gd-2.1.0-24.17.1 as a component of Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production gd-2.1.0-24.17.1 as a component of Image SLES12-SP4-SAP-EC2-HVM gd-2.1.0-24.17.1 as a component of Image SLES12-SP4-SAP-EC2-HVM-BYOS gd-2.1.0-24.17.1 as a component of Image SLES12-SP4-SAP-GCE gd-2.1.0-24.17.1 as a component of Image SLES12-SP4-SAP-GCE-BYOS gd-2.1.0-24.17.1 as a component of Image SLES12-SP4-SAP-OCI-BYOS gd-2.1.0-24.17.1 as a component of Image SLES12-SP5-Azure-SAP-BYOS gd-2.1.0-24.17.1 as a component of Image SLES12-SP5-Azure-SAP-On-Demand gd-2.1.0-24.17.1 as a component of Image SLES12-SP5-EC2-SAP-BYOS gd-2.1.0-24.17.1 as a component of Image SLES12-SP5-EC2-SAP-On-Demand gd-2.1.0-24.17.1 as a component of Image SLES12-SP5-GCE-SAP-BYOS gd-2.1.0-24.17.1 as a component of Image SLES12-SP5-GCE-SAP-On-Demand gd-2.1.0-24.17.1 as a component of Image SLES12-SP5-OCI-BYOS-SAP-BYOS gd-2.1.0-24.17.1 as a component of Image SLES12-SP5-SAP-Azure-LI-BYOS-Production gd-2.1.0-24.17.1 as a component of Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production gd-2.1.0-24.17.1 as a component of SUSE Linux Enterprise Desktop 12 SP4 gd-32bit-2.1.0-24.17.1 as a component of SUSE Linux Enterprise Desktop 12 SP4 gd-2.1.0-24.17.1 as a component of SUSE Linux Enterprise Server 12 SP4 gd-2.1.0-24.17.1 as a component of SUSE Linux Enterprise Server 12 SP5 gd-2.1.0-24.17.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 gd-2.1.0-24.17.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 gd-devel-2.1.0-24.17.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP4 gd-devel-2.1.0-24.17.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 gd-32bit-2.1.0-24.17.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP4 gd-32bit-2.1.0-24.17.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.31 and 7.x before 7.1.7, does not zero colorMap arrays before use. A specially crafted GIF image could use the uninitialized tables to read ~700 bytes from the top of the stack, potentially disclosing sensitive information. CVE-2017-7890 Container caasp/v4/nginx-ingress-controller:beta1:gd-2.1.0-24.17.1 Image SLES12-SP4-SAP-Azure-BYOS:gd-2.1.0-24.17.1 Image SLES12-SP4-SAP-Azure-LI-BYOS-Production:gd-2.1.0-24.17.1 Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production:gd-2.1.0-24.17.1 Image SLES12-SP4-SAP-Azure:gd-2.1.0-24.17.1 Image SLES12-SP4-SAP-EC2-HVM-BYOS:gd-2.1.0-24.17.1 Image SLES12-SP4-SAP-EC2-HVM:gd-2.1.0-24.17.1 Image SLES12-SP4-SAP-GCE-BYOS:gd-2.1.0-24.17.1 Image SLES12-SP4-SAP-GCE:gd-2.1.0-24.17.1 Image SLES12-SP4-SAP-OCI-BYOS:gd-2.1.0-24.17.1 Image SLES12-SP5-Azure-SAP-BYOS:gd-2.1.0-24.17.1 Image SLES12-SP5-Azure-SAP-On-Demand:gd-2.1.0-24.17.1 Image SLES12-SP5-EC2-SAP-BYOS:gd-2.1.0-24.17.1 Image SLES12-SP5-EC2-SAP-On-Demand:gd-2.1.0-24.17.1 Image SLES12-SP5-GCE-SAP-BYOS:gd-2.1.0-24.17.1 Image SLES12-SP5-GCE-SAP-On-Demand:gd-2.1.0-24.17.1 Image SLES12-SP5-OCI-BYOS-SAP-BYOS:gd-2.1.0-24.17.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:gd-2.1.0-24.17.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:gd-2.1.0-24.17.1 SUSE Linux Enterprise Desktop 12 SP4:gd-2.1.0-24.17.1 SUSE Linux Enterprise Desktop 12 SP4:gd-32bit-2.1.0-24.17.1 SUSE Linux Enterprise Server 12 SP4:gd-2.1.0-24.17.1 SUSE Linux Enterprise Server 12 SP5:gd-2.1.0-24.17.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:gd-2.1.0-24.17.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:gd-2.1.0-24.17.1 SUSE Linux Enterprise Software Development Kit 12 SP4:gd-devel-2.1.0-24.17.1 SUSE Linux Enterprise Software Development Kit 12 SP5:gd-devel-2.1.0-24.17.1 SUSE Linux Enterprise Workstation Extension 12 SP4:gd-32bit-2.1.0-24.17.1 SUSE Linux Enterprise Workstation Extension 12 SP5:gd-32bit-2.1.0-24.17.1 low 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20200623-1/ https://www.suse.com/security/cve/CVE-2017-7890.html CVE-2017-7890 https://bugzilla.suse.com/1050241 SUSE Bug 1050241 gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a NULL pointer dereference allowing attackers to crash an application via a specific function call sequence. Only affects PHP when linked with an external libgd (not bundled). CVE-2018-14553 Container caasp/v4/nginx-ingress-controller:beta1:gd-2.1.0-24.17.1 Image SLES12-SP4-SAP-Azure-BYOS:gd-2.1.0-24.17.1 Image SLES12-SP4-SAP-Azure-LI-BYOS-Production:gd-2.1.0-24.17.1 Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production:gd-2.1.0-24.17.1 Image SLES12-SP4-SAP-Azure:gd-2.1.0-24.17.1 Image SLES12-SP4-SAP-EC2-HVM-BYOS:gd-2.1.0-24.17.1 Image SLES12-SP4-SAP-EC2-HVM:gd-2.1.0-24.17.1 Image SLES12-SP4-SAP-GCE-BYOS:gd-2.1.0-24.17.1 Image SLES12-SP4-SAP-GCE:gd-2.1.0-24.17.1 Image SLES12-SP4-SAP-OCI-BYOS:gd-2.1.0-24.17.1 Image SLES12-SP5-Azure-SAP-BYOS:gd-2.1.0-24.17.1 Image SLES12-SP5-Azure-SAP-On-Demand:gd-2.1.0-24.17.1 Image SLES12-SP5-EC2-SAP-BYOS:gd-2.1.0-24.17.1 Image SLES12-SP5-EC2-SAP-On-Demand:gd-2.1.0-24.17.1 Image SLES12-SP5-GCE-SAP-BYOS:gd-2.1.0-24.17.1 Image SLES12-SP5-GCE-SAP-On-Demand:gd-2.1.0-24.17.1 Image SLES12-SP5-OCI-BYOS-SAP-BYOS:gd-2.1.0-24.17.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:gd-2.1.0-24.17.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:gd-2.1.0-24.17.1 SUSE Linux Enterprise Desktop 12 SP4:gd-2.1.0-24.17.1 SUSE Linux Enterprise Desktop 12 SP4:gd-32bit-2.1.0-24.17.1 SUSE Linux Enterprise Server 12 SP4:gd-2.1.0-24.17.1 SUSE Linux Enterprise Server 12 SP5:gd-2.1.0-24.17.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:gd-2.1.0-24.17.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:gd-2.1.0-24.17.1 SUSE Linux Enterprise Software Development Kit 12 SP4:gd-devel-2.1.0-24.17.1 SUSE Linux Enterprise Software Development Kit 12 SP5:gd-devel-2.1.0-24.17.1 SUSE Linux Enterprise Workstation Extension 12 SP4:gd-32bit-2.1.0-24.17.1 SUSE Linux Enterprise Workstation Extension 12 SP5:gd-32bit-2.1.0-24.17.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20200623-1/ https://www.suse.com/security/cve/CVE-2018-14553.html CVE-2018-14553 https://bugzilla.suse.com/1165471 SUSE Bug 1165471 When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been left there by previous code. CVE-2019-11038 Container caasp/v4/nginx-ingress-controller:beta1:gd-2.1.0-24.17.1 Image SLES12-SP4-SAP-Azure-BYOS:gd-2.1.0-24.17.1 Image SLES12-SP4-SAP-Azure-LI-BYOS-Production:gd-2.1.0-24.17.1 Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production:gd-2.1.0-24.17.1 Image SLES12-SP4-SAP-Azure:gd-2.1.0-24.17.1 Image SLES12-SP4-SAP-EC2-HVM-BYOS:gd-2.1.0-24.17.1 Image SLES12-SP4-SAP-EC2-HVM:gd-2.1.0-24.17.1 Image SLES12-SP4-SAP-GCE-BYOS:gd-2.1.0-24.17.1 Image SLES12-SP4-SAP-GCE:gd-2.1.0-24.17.1 Image SLES12-SP4-SAP-OCI-BYOS:gd-2.1.0-24.17.1 Image SLES12-SP5-Azure-SAP-BYOS:gd-2.1.0-24.17.1 Image SLES12-SP5-Azure-SAP-On-Demand:gd-2.1.0-24.17.1 Image SLES12-SP5-EC2-SAP-BYOS:gd-2.1.0-24.17.1 Image SLES12-SP5-EC2-SAP-On-Demand:gd-2.1.0-24.17.1 Image SLES12-SP5-GCE-SAP-BYOS:gd-2.1.0-24.17.1 Image SLES12-SP5-GCE-SAP-On-Demand:gd-2.1.0-24.17.1 Image SLES12-SP5-OCI-BYOS-SAP-BYOS:gd-2.1.0-24.17.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:gd-2.1.0-24.17.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:gd-2.1.0-24.17.1 SUSE Linux Enterprise Desktop 12 SP4:gd-2.1.0-24.17.1 SUSE Linux Enterprise Desktop 12 SP4:gd-32bit-2.1.0-24.17.1 SUSE Linux Enterprise Server 12 SP4:gd-2.1.0-24.17.1 SUSE Linux Enterprise Server 12 SP5:gd-2.1.0-24.17.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:gd-2.1.0-24.17.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:gd-2.1.0-24.17.1 SUSE Linux Enterprise Software Development Kit 12 SP4:gd-devel-2.1.0-24.17.1 SUSE Linux Enterprise Software Development Kit 12 SP5:gd-devel-2.1.0-24.17.1 SUSE Linux Enterprise Workstation Extension 12 SP4:gd-32bit-2.1.0-24.17.1 SUSE Linux Enterprise Workstation Extension 12 SP5:gd-32bit-2.1.0-24.17.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20200623-1/ https://www.suse.com/security/cve/CVE-2019-11038.html CVE-2019-11038 https://bugzilla.suse.com/1140118 SUSE Bug 1140118 https://bugzilla.suse.com/1140120 SUSE Bug 1140120