CVE-2018-1000222

HIGH 8.8CVE-2018-1000222 · Published 20/08/2018 · updated 17/06/2026

Package	Affected versions	Patched versions
libgd libgd	`= 2.2.5`	No fix yet

Description

Libgd version 2.2.5 contains a Double Free Vulnerability vulnerability in gdImageBmpPtr Function that can result in Remote Code Execution . This attack appear to be exploitable via Specially Crafted Jpeg Image can trigger double free. This vulnerability appears to have been fixed in after commit ac16bdf2d41724b5a65255d4c28fb0ec46bc42f5.

References

libgd/libgd · Issue Tracking
lists.debian.org/debian-lts-announce/2019/01/msg00028.html · Mailing List
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3CZ2QADQTKRHTGB2AHD7J4QQNDLBEMM6
security.gentoo.org/glsa/201903-18 · Third Party Advisory
usn.ubuntu.com/3755-1 · Mitigation

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free