CVE-2004-0990

Description

Integer overflow in GD Graphics Library libgd 2.0.28 (libgd2), and possibly other versions, allows remote attackers to cause a denial of service and possibly execute arbitrary code via PNG image files with large image rows values that lead to a heap-based buffer overflow in the gdImageCreateFromPngCtx function, a different set of vulnerabilities than CVE-2004-0941.

10.0

CVSS

Severity: Critical

CVSS 2.0 •

EPSS 36.68% Top 5%

Vendor Advisory redhat.com Vendor Advisory debian.org Vendor Advisory mandriva.com Vendor Advisory suse.com Vendor Advisory trustix.org Vendor Advisory debian.org Vendor Advisory mandriva.com Vendor Advisory debian.org Vendor Advisory mandriva.com Vendor Advisory mandriva.com Vendor Advisory ubuntu.com Vendor Advisory ubuntu.com Vendor Advisory debian.org Vendor Advisory securityfocus.com

Affected: n/a n/a

References

Link	Tags
http://www.ciac.org/ciac/bulletins/p-071.shtml	third party advisory government resource
http://secunia.com/advisories/23783	third party advisory
http://www.osvdb.org/11190	vdb entry
http://secunia.com/advisories/21050	third party advisory
http://www.securityfocus.com/bid/11523	vdb entry patch vendor advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/17866	vdb entry
http://www.redhat.com/support/errata/RHSA-2004-638.html	vendor advisory
http://www.debian.org/security/2004/dsa-602	vendor advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2006:113	vendor advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1260	vdb entry signature
http://lists.suse.com/archive/suse-security-announce/2006-Feb/0001.html	vendor advisory
http://www.trustix.org/errata/2004/0058	vendor advisory
https://issues.rpath.com/browse/RPL-939
http://www.debian.org/security/2004/dsa-589	vendor advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2006:114	vendor advisory
http://www.debian.org/security/2004/dsa-601	vendor advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2004:132	vendor advisory
http://secunia.com/advisories/18717	third party advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2006:122	vendor advisory
https://www.ubuntu.com/usn/usn-25-1/	vendor advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9952	vdb entry signature
http://marc.info/?l=bugtraq&m=109882489302099&w=2	mailing list
https://www.ubuntu.com/usn/usn-11-1/	vendor advisory
http://secunia.com/advisories/20824	third party advisory
http://www.debian.org/security/2004/dsa-591	vendor advisory
http://secunia.com/advisories/20866	third party advisory

Frequently Asked Questions

What is the severity of CVE-2004-0990?: CVE-2004-0990 has been scored as a critical severity vulnerability.
How to fix CVE-2004-0990?: To fix CVE-2004-0990, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2004-0990 being actively exploited in the wild?: It is possible that CVE-2004-0990 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~37% probability that this vulnerability will be exploited by malicious actors in the next 30 days.