libgd2: Infinite loop in PNG loader.

Debian Bug report logs - #425584
libgd2: Infinite loop in PNG loader.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: "Pierre A. Joye" <pierre@bugs.libgd.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: libgd2: Infinite loop in PNG loader.

Date: Tue, 22 May 2007 18:45:01 +0200

Package: libgd2
Version: 2.0.33
Severity: normal


See cve-2007-2756 and/or http://bugs.libgd.org/?do=details&task_id=86
Patch to fix this issue:
http://pierre.libgd.org/debian/cve-2007-2756_patch.txt (already applied
in gd cvs and php-gd cvs in cvs.php.net)

-- System Information:
Debian Release: 3.1
Architecture: i386 (i686)
Kernel: Linux 2.4.33grs-bipiv-ipv4-32
Locale: LANG=en_GB, LC_CTYPE=en_GB (charmap=ISO-8859-1)

Versions of packages libgd2 depends on:
ii  libc6                 2.3.2.ds1-22sarge4 GNU C Library: Shared libraries an
ii  libfreetype6          2.1.7-6            FreeType 2 font engine, shared lib
ii  libjpeg62             6b-10              The Independent JPEG Group's JPEG 
ii  libpng2               1.0.18-1           PNG library, older version - runti
pn  xlibs                                    Not found.
ii  zlib1g                1:1.2.2-4.sarge.2  compression library - runtime

Message #16 received at 425584@bugs.debian.org (full text, mbox, reply):

From: sean finney <seanius@debian.org>

To: 425978@bugs.debian.org, 408982@bugs.debian.org, 426100@bugs.debian.org, 425754@bugs.debian.org, 425584@bugs.debian.org

Subject: patch for security issues

Date: Tue, 29 May 2007 23:08:53 +0200

[Message part 1 (text/plain, inline)]

hi,

i previously emailed jonas tonight with a patch that can be used to 
incorporate fixes for the above bugs in etch.  for posterity, here it is.  i 
hear there are going to be a few more security issues surfacing in the near 
future, so i won't be sending this to the security team yet, but if i haven't 
heard a request not to do so i will probably do so after the other issues are 
dealt with.


	sean

[libgd2_2.0.33-5.2etch4.interdiff (text/x-diff, attachment)]

[signature.asc (application/pgp-signature, inline)]

Message #23 received at 425584-done@bugs.debian.org (full text, mbox, reply):

From: Ondřej Surý <ondrej@sury.org>

To: 425584-done@bugs.debian.org, 426099-done@bugs.debian.org

Subject: Fixed in at least upstream 2.0.36~rc1

Date: Fri, 12 Apr 2013 08:32:31 +0200

Version: 2.0.36~rc1~dfsg-1

--
Ondřej Surý <ondrej@sury.org>

Send a report that this bug log contains spam.