Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2017.0011
libgd2 security update
3 January 2017
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: libgd2
Publisher: Debian
Operating System: Debian GNU/Linux 8
UNIX variants (UNIX, Linux, OSX)
Impact/Access: Denial of Service -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2016-9933
Reference: ESB-2016.2944.2
Original Bulletin:
http://www.debian.org/security/2017/dsa-3751
Comment: This advisory references vulnerabilities in products which run on
platforms other than Debian. It is recommended that administrators
running libgd2 check for an updated version of the software for
their operating system.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-3751-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
January 01, 2017 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : libgd2
CVE ID : CVE-2016-9933
Debian Bug : 849038
A stack overflow vulnerability was discovered within the
gdImageFillToBorder function in libgd2, a library for programmatic
graphics creation and manipulation, triggered when invalid colors are
used with truecolor images. A remote attacker can take advantage of this
flaw to cause a denial-of-service against an application using the
libgd2 library.
For the stable distribution (jessie), this problem has been fixed in
version 2.1.0-5+deb8u8.
For the testing distribution (stretch), this problem has been fixed
in version 2.2.2-29-g3c2b605-1.
For the unstable distribution (sid), this problem has been fixed in
version 2.2.2-29-g3c2b605-1.
We recommend that you upgrade your libgd2 packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlhpNeBfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0Rvjw/9ERJvLtD/x0p4jEP6p3iUkPyDig0xVZLuAtcHcHKWb+HdNf3W3iOCp3Qz
H/ybWGxno3lDBFTzjaqFq9RUf1+SanbqHfEnQ22UQuKhXgiLaxDXKoIKBgUrcvl0
zdVvH+SHon5f17vUOKzWR9GVV+Aqwe6B461uS/BRA8UsaxiViBndGd1YLd3y17g4
hHWICoRSxEwm5NjWsFXQQRfuDuEp4MwSv5a71WPZ0s9EjlbvMCFIYcwaFhFDF3de
UjeeWk2nwZY+z4nZD6G1PKrdCNs3JiA5pfswM3hEsdyd9xq0uNUXkFYv/V9kPCHy
s5JVT5qnCGI6UNkWQk50I8GN0hV4+b8o2h9q5XCxwhPXRby6N3qkcq5ZyiW9jjr/
CVf6nVMkWHfDDAsFFSE5taUpwSPCYzb7GPK648X2qODlIg+7uOMCZBDs1t3yAWdU
RyRjVLSXcvfy7TeDriFcOlqgsMMAclowQYYO4PINtV3yKMBcl8dqzbVQBAu5Z5Bx
820rvTA15JOM0GIkOATFJUhX1PzxcrvGAP458yCCbzap9PHVcYLvTiaW5Y/zFiqU
WhS1YnKtJfe/YQ+T99+VXQgFAvdL0+wN6R7sTYWl/m/c5WUk4jXFkEkneweoGKUe
SEPsD57Cljauai/rAhD7i4L6YQJYt0jvnu2wffQ6mTPPDcFEZtU=
=CDTq
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWGsyOox+lLeg9Ub1AQhZzw/+Pve6O4s461EgKWpW9X38iSUd2cUn4M5b
nVTkLoxV5CUClNg2yjyhr0esvRdgS9K8JF0ECjKH/oM1//fW/8EkfrEul7bYupfd
OxEb7zs8WYyoCXp8ndJwhEPuZ3B9zqh4w0nmwXsfKg6GJDW0V/t95xD6SkWPcwWj
EZrV7dS6sxv/T/8Yx+unIXlyOI9CJf2ReA7vwiHQGxMoL/Y2sSK56OS4aAcJA9/J
c+cJqZleAvwos+/CBaUlxoQK3iwTjNs8YDWmnzCBQ+VEZvKpU0NJo8Ok1wQ+wzQA
MGHng8oiU6HF+MF8zPBI9KaFkio+TwQo3rVUMzFvPCyZrzYFVdt3PadC2E+pWpIB
sLv530+DFBnOufDITJ3+7h4DrdSEvvcDf0lvj0GByXr0eG+XwCq6i52EBD87bTbF
Fc9kQjkF6Z6kNrZDnz1nkbS/efTcbAL1j0wxZ/vA5r+eeJdFCE8i8IuQU7BQWl9I
Sj7EiKldlL+2dXeQ4gI5Qbh+FO+6Mv0rJOe0ZpW2arYJRgdddmQKGzMkJqIOch9b
mjJJ7NKe2VCUQfcqXGx9/u7O5MfD7TQBcuHMM4qoOlAzmOmJiaj0jGZZQzlNj3cO
sljBLyFBWwjxtQwmyZPhWjHqL3vRqG3pw4DdzJQb49oMCoDGugvDQqPXSiabiKiK
MrUh6uFO8Hs=
=pDG+
-----END PGP SIGNATURE-----