CVE-2007-3996

Name	CVE-2007-3996
Description	Multiple integer overflows in libgd in PHP before 5.2.4 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large (1) srcW or (2) srcH value to the (a) gdImageCopyResized function, or a large (3) sy (height) or (4) sx (width) value to the (b) gdImageCreate or the (c) gdImageCreateTrueColor function.
Source	CVE (at NVD; oss-sec, fulldisc, OSVDB, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, more)
References	DSA-1613-1
NVD severity	medium (attack range: remote)
Debian Bugs	443456, 601525
Debian/oldstable	package libwmf is vulnerable; however, the security impact is unimportant.
Debian/stable	package libwmf is vulnerable; however, the security impact is unimportant.
Debian/testing	package libwmf is vulnerable; however, the security impact is unimportant.
Debian/unstable	package libwmf is vulnerable; however, the security impact is unimportant.

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libgd2 (PTS)	squeeze	2.0.36~rc1~dfsg-5	fixed
	wheezy	2.0.36~rc1~dfsg-6.1	fixed
	jessie, sid	2.1.0-5	fixed
libwmf (PTS)	squeeze	0.2.8.4-6.1	vulnerable
	jessie, sid, wheezy	0.2.8.4-10.3	vulnerable
racket (PTS)	wheezy	5.2.1+g6~92c8784+dfsg2-2+deb7u1	fixed
	jessie, sid	6.1-4	fixed

The information above is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libgd2	source	(unstable)	2.0.35.dfsg-1	medium		443456
libgd2	source	etch	2.0.33-5.2etch1	medium	DSA-1613-1
libwmf	source	(unstable)	(unfixed)	unimportant
racket	source	(unstable)	5.0.2-1	unimportant		601525

Notes

Only present in one of the sample pl-scheme packages (plot)
Debian's PHP packages are linked dynamically against libgd
see http://www.php.net/releases/5_2_4.php