Bug 991710

Summary:	VUL-1: CVE-2016-6128: gd: Invalid color index not properly handled
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Sebastian Krahmer <krahmer>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P4 - Low	CC:	astieger, security-team, smash_bz, vpereira
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/170569/
Whiteboard:	CVSSv2:SUSE:CVE-2016-6128:4.3:(AV:N/AC:M/Au:N/C:N/I:N/A:P) CVSSv2:RedHat:CVE-2016-6128:4.3:(AV:N/AC:M/Au:N/C:N/I:N/A:P) maint:running:62929:moderate
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---
Bug Depends on:	987580
Bug Blocks:

Description Sebastian Krahmer 2016-08-02 13:27:52 UTC

+++ This bug was initially created as a clone of Bug #987580 +++

http://seclists.org/oss-sec/2016/q2/627

    There is currently PHP upstream bug which is still marked as private:

    https://bugs.php.net/bug.php?id=72494

    But the libgd project references the following set of commits to this
    bug report:

    https://github.com/libgd/libgd/compare/3fe0a71...6ff72ae

    indicating that libgd does not properly handle invalid color index,
    which could lead to a denial of service against applications using the
    libgd library (in particular thus PHP).


    https://github.com/libgd/libgd/commit/1ccfe21e14c4d18336f9da8515cd17db88c3de61
    gd_crop.c
    gdImageCropThreshold

    + if (color < 0 || (!gdImageTrueColor(im) && color >= gdImageColorsTotal(im))) {
    + return NULL;
    + }

    https://github.com/libgd/libgd/commit/6ff72ae40c7c20ece939afb362d98cc37f4a1c96
    tests/gdimagecrop/php_bug_72494.c

    im = gdImageCreate(50, 50);
    gdImageCropThreshold(im, 1337, 0);
    gdImageDestroy(im);



https://github.com/libgd/libgd/compare/3fe0a7128bac5000fdcfab888bd2a75ec0c9447d...fd623025505e87bba7ec8555eeb72dae4fb0afd


References:
https://bugzilla.redhat.com/show_bug.cgi?id=1351603
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-6128
http://seclists.org/oss-sec/2016/q2/627
http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-6128.html

Comment 1 Petr Gajdos 2016-08-08 11:48:57 UTC

Again, imho color can not be lower than zero.

Comment 2 Sebastian Krahmer 2016-08-08 11:54:59 UTC

Maybe. But either case, having this patch wont hurt us and keeping us aligned
with upstream patchset.
(If color cant be < 0, I wonder why they are using signed ints anyway)

Comment 3 Petr Gajdos 2016-08-08 12:38:50 UTC

No, color is unsigned int.

But they noticed it already:
https://github.com/libgd/libgd/commit/e29a140290a084b0aa590c5edbb596060aa44acb

Comment 4 Petr Gajdos 2016-08-08 12:44:33 UTC

affected: 13.2/gd, 12/gd
not affected: 11/gd

Comment 5 Petr Gajdos 2016-08-08 13:37:38 UTC

I believe all affected code streams are fixed.

Comment 6 Bernhard Wiedemann 2016-08-08 14:01:23 UTC

This is an autogenerated message for OBS integration:
This bug (991710) was mentioned in
https://build.opensuse.org/request/show/417845 13.2 / gd

Comment 8 Swamp Workflow Management 2016-08-19 17:11:15 UTC

openSUSE-SU-2016:2117-1: An update that fixes 5 vulnerabilities is now available.

Category: security (moderate)
Bug References: 987577,988032,991436,991622,991710
CVE References: CVE-2016-6128,CVE-2016-6132,CVE-2016-6161,CVE-2016-6207,CVE-2016-6214
Sources used:
openSUSE 13.2 (src):    gd-2.1.0-7.11.1

Comment 10 Swamp Workflow Management 2016-09-14 11:11:20 UTC

SUSE-SU-2016:2303-1: An update that fixes 7 vulnerabilities is now available.

Category: security (moderate)
Bug References: 982176,987577,988032,991436,991622,991710,995034
CVE References: CVE-2016-5116,CVE-2016-6128,CVE-2016-6132,CVE-2016-6161,CVE-2016-6207,CVE-2016-6214,CVE-2016-6905
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP1 (src):    gd-2.1.0-12.1
SUSE Linux Enterprise Software Development Kit 12-SP1 (src):    gd-2.1.0-12.1
SUSE Linux Enterprise Server 12-SP1 (src):    gd-2.1.0-12.1
SUSE Linux Enterprise Desktop 12-SP1 (src):    gd-2.1.0-12.1

Comment 11 Swamp Workflow Management 2016-09-24 00:10:05 UTC

openSUSE-SU-2016:2363-1: An update that fixes 7 vulnerabilities is now available.

Category: security (moderate)
Bug References: 982176,987577,988032,991436,991622,991710,995034
CVE References: CVE-2016-5116,CVE-2016-6128,CVE-2016-6132,CVE-2016-6161,CVE-2016-6207,CVE-2016-6214,CVE-2016-6905
Sources used:
openSUSE Leap 42.1 (src):    gd-2.1.0-10.1

Comment 12 Victor Pereira 2016-10-24 07:23:07 UTC

all updates released