CVE-2019-6978

CRITICAL 9.8CVE-2019-6978 · Published 28/01/2019 · updated 17/06/2026

Package	Affected versions	Patched versions
libgd libgd	`= 2.2.5`	No fix yet

Description

The GD Graphics Library (aka LibGD) 2.2.5 has a double free in the gdImage*Ptr() functions in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c. NOTE: PHP is unaffected.

References

lists.opensuse.org/opensuse-security-announce/2019-04/msg00025.html
lists.opensuse.org/opensuse-security-announce/2019-04/msg00031.html
access.redhat.com/errata/RHSA-2019:2722
libgd/libgd commit 5537029 · Patch
libgd/libgd · Patch
php/php-src commit 089f7c0 · Patch
lists.debian.org/debian-lts-announce/2019/01/msg00028.html · Mailing List
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3CZ2QADQTKRHTGB2AHD7J4QQNDLBEMM6
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3WRUPZVT2MWFUEMVGTRAGDOBHLNMGK5R
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TEYUUOW75YD3DENIPYMO263E6NL2NFHI
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TTXSLRZI5BCQT3H5KALG3DHUWUMNPDX2
security.gentoo.org/glsa/201903-18 · Third Party Advisory
usn.ubuntu.com/3900-1 · Third Party Advisory
debian.org/security/2019/dsa-4384 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free