CVE-2014-2497

NameCVE-2014-2497
DescriptionThe gdImageCreateFromXpm function in gdxpm.c in libgd, as used in PHP 5.4.26 and earlier, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted color table in an XPM file.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-189-1, DSA-3215-1
Debian Bugs744719

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libgd2 (PTS)bullseye2.3.0-2fixed
bookworm2.3.3-9fixed
sid, trixie2.3.3-12fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libgd2sourcesqueeze2.0.36~rc1~dfsg-5+deb6u1DLA-189-1
libgd2sourcewheezy2.0.36~rc1~dfsg-6.1+deb7u1DSA-3215-1
libgd2source(unstable)2.1.0-4low744719
php5sourcesqueeze(not affected)
php5sourcewheezy(not affected)
php5source(unstable)5.6.0~rc4+dfsg-1

Notes

[wheezy] - php5 <not-affected> (imagecreatefromxpm function not in used gd extension)
[squeeze] - php5 <not-affected> (imagecreatefromxpm function not in used gd extension)
http://web.archive.org/web/20150221193227/http://net-ninja-mr.me/2014/03/14/php-gd-v5-4-17-2-color-visual-null-pointer-dereference/

Search for package or bug name: Reporting problems