Bug 1105434 - (CVE-2018-1000222) VUL-0: CVE-2018-1000222: php5,gd,php7,php53: a Double Free Vulnerability vulnerability in gdImageBmpPtr Function that can result in Remote Code Execution
(CVE-2018-1000222)
VUL-0: CVE-2018-1000222: php5,gd,php7,php53: a Double Free Vulnerability vul...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Minor
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/213102/
CVSSv3:SUSE:CVE-2018-1000222:7.0:(AV:...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2018-08-21 05:20 UTC by Marcus Meissner
Modified: 2021-09-14 12:47 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2018-08-21 05:20:29 UTC
CVE-2018-1000222

Libgd version 2.2.5 contains a Double Free Vulnerability vulnerability in
gdImageBmpPtr Function that can result in Remote Code Execution . This attack
appear to be exploitable via Specially Crafted Jpeg Image can trigger double
free. This vulnerability appears to have been fixed in after commit
ac16bdf2d41724b5a65255d4c28fb0ec46bc42f5.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1000222
https://github.com/libgd/libgd/issues/447
Comment 1 Petr Gajdos 2018-08-27 13:29:57 UTC
No testcase found.
Comment 2 Petr Gajdos 2018-08-27 14:22:35 UTC
Will submit for: devel/gd, 15/gd, 12/gd and 15/php7.

Older ones does not have BMP support.
Comment 3 Swamp Workflow Management 2018-08-27 14:40:05 UTC
This is an autogenerated message for OBS integration:
This bug (1105434) was mentioned in
https://build.opensuse.org/request/show/631813 Factory / gd
Comment 4 Petr Gajdos 2018-08-27 15:12:26 UTC
Packages submitted.
Comment 8 Swamp Workflow Management 2018-09-24 16:11:44 UTC
SUSE-SU-2018:2837-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1105434
CVE References: CVE-2018-1000222
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP3 (src):    gd-2.1.0-24.9.1
SUSE Linux Enterprise Software Development Kit 12-SP3 (src):    gd-2.1.0-24.9.1
SUSE Linux Enterprise Server 12-SP3 (src):    gd-2.1.0-24.9.1
SUSE Linux Enterprise Desktop 12-SP3 (src):    gd-2.1.0-24.9.1
Comment 9 Swamp Workflow Management 2018-09-24 16:13:41 UTC
SUSE-SU-2018:2840-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1105434
CVE References: CVE-2018-1000222
Sources used:
SUSE Linux Enterprise Module for Web Scripting 15 (src):    php7-7.2.5-4.9.1
Comment 10 Swamp Workflow Management 2018-09-25 13:08:28 UTC
openSUSE-SU-2018:2849-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1105434
CVE References: CVE-2018-1000222
Sources used:
openSUSE Leap 15.0 (src):    php7-7.2.5-lp150.2.12.1
Comment 11 Swamp Workflow Management 2018-09-25 13:10:12 UTC
openSUSE-SU-2018:2851-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1105434
CVE References: CVE-2018-1000222
Sources used:
openSUSE Leap 42.3 (src):    gd-2.1.0-27.1
Comment 12 Swamp Workflow Management 2018-09-27 10:11:13 UTC
SUSE-SU-2018:2888-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1105434
CVE References: CVE-2018-1000222
Sources used:
SUSE Linux Enterprise Module for Desktop Applications 15 (src):    gd-2.2.5-4.3.1
SUSE Linux Enterprise Module for Basesystem 15 (src):    gd-2.2.5-4.3.1
Comment 13 Swamp Workflow Management 2018-09-28 19:08:09 UTC
openSUSE-SU-2018:2941-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1105434
CVE References: CVE-2018-1000222
Sources used:
openSUSE Leap 15.0 (src):    gd-2.2.5-lp150.3.3.1
Comment 21 Marcus Meissner 2019-07-04 06:29:01 UTC
released
Comment 24 OBSbugzilla Bot 2020-05-12 08:00:22 UTC
This is an autogenerated message for OBS integration:
This bug (1105434) was mentioned in
https://build.opensuse.org/request/show/802846 Factory / php7
Comment 25 OBSbugzilla Bot 2020-05-12 14:00:07 UTC
This is an autogenerated message for OBS integration:
This bug (1105434) was mentioned in
https://build.opensuse.org/request/show/802978 Factory / php7
Comment 26 OBSbugzilla Bot 2020-05-13 08:20:05 UTC
This is an autogenerated message for OBS integration:
This bug (1105434) was mentioned in
https://build.opensuse.org/request/show/804946 Factory / php7