CVE-2007-2756

Description

The gdPngReadData function in libgd 2.0.34 allows user-assisted attackers to cause a denial of service (CPU consumption) via a crafted PNG image with truncated data, which causes an infinite loop in the png_read_info function in libpng.

4.3

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 6.46% Top 10%

Vendor Advisory openpkg.com Vendor Advisory redhat.com Vendor Advisory mandriva.com Vendor Advisory gentoo.org Vendor Advisory gentoo.org Vendor Advisory mandriva.com Vendor Advisory gentoo.org Vendor Advisory mandriva.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory trustix.org Vendor Advisory trustix.org Vendor Advisory novell.com Vendor Advisory gentoo.org Vendor Advisory slackware.com Vendor Advisory redhat.com Vendor Advisory hp.com Vendor Advisory mandriva.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory ubuntu.com Vendor Advisory opensuse.org

Affected: n/a n/a

References

Link	Tags
http://secunia.com/advisories/26231	third party advisory
http://osvdb.org/36643	vdb entry
http://www.securitytracker.com/id?1018187	vdb entry
http://secunia.com/advisories/29157	third party advisory
http://secunia.com/advisories/25658	third party advisory
http://secunia.com/advisories/27110	third party advisory
http://secunia.com/advisories/25590	third party advisory
http://secunia.com/advisories/26048	third party advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/34420	vdb entry
http://secunia.com/advisories/25362	third party advisory
http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.020.html	vendor advisory
http://secunia.com/advisories/25657	third party advisory
https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00354.html	vendor advisory
http://secunia.com/advisories/25855	third party advisory
http://secunia.com/advisories/26967	third party advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2007:122	vendor advisory
http://www.vupen.com/english/advisories/2007/2016	vdb entry
http://security.gentoo.org/glsa/glsa-200805-13.xml	vendor advisory
http://www.gentoo.org/security/en/glsa/glsa-200710-02.xml	vendor advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2007:123	vendor advisory
http://www.securityfocus.com/bid/24089	vdb entry
http://www.libgd.org/ReleaseNote020035
http://security.gentoo.org/glsa/glsa-200708-05.xml	vendor advisory
http://secunia.com/advisories/30168	third party advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2007:124	vendor advisory
http://www.vupen.com/english/advisories/2007/1904	vdb entry
http://secunia.com/advisories/26930	third party advisory
http://osvdb.org/35788	vdb entry
https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00397.html	vendor advisory
http://www.vupen.com/english/advisories/2007/2336	vdb entry
http://rhn.redhat.com/errata/RHSA-2007-0889.html	vendor advisory
http://www.trustix.org/errata/2007/0023/	vendor advisory
http://secunia.com/advisories/25353	third party advisory
http://www.vupen.com/english/advisories/2007/3386	vdb entry
http://bugs.libgd.org/?do=details&task_id=86	patch
http://www.trustix.org/errata/2007/0019/	vendor advisory
http://secunia.com/advisories/27037	third party advisory
http://www.novell.com/linux/security/advisories/2007_13_sr.html	vendor advisory
http://secunia.com/advisories/25378	third party advisory
http://secunia.com/advisories/27545	third party advisory
http://security.gentoo.org/glsa/glsa-200711-34.xml	vendor advisory
http://support.avaya.com/elmodocs2/security/ASA-2007-449.htm
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.482863	vendor advisory
http://secunia.com/advisories/25646	third party advisory
http://www.redhat.com/support/errata/RHSA-2008-0146.html	vendor advisory
http://www.php.net/releases/5_2_3.php
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795	vendor advisory
https://issues.rpath.com/browse/RPL-1394
http://secunia.com/advisories/25535	third party advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2007:187	vendor advisory
http://secunia.com/advisories/27102	third party advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10779	vdb entry signature
http://secunia.com/advisories/26895	third party advisory
http://secunia.com/advisories/25787	third party advisory
http://secunia.com/advisories/25575	third party advisory
http://www.redhat.com/support/errata/RHSA-2007-0890.html	vendor advisory
http://www.vupen.com/english/advisories/2007/1905	vdb entry
http://secunia.com/advisories/26390	third party advisory
http://www.redhat.com/support/errata/RHSA-2007-0891.html	vendor advisory
http://www.ubuntu.com/usn/usn-473-1	vendor advisory
http://secunia.com/advisories/26871	third party advisory
http://lists.opensuse.org/opensuse-security-announce/2007-07/msg00006.html	vendor advisory

Frequently Asked Questions

What is the severity of CVE-2007-2756?: CVE-2007-2756 has been scored as a medium severity vulnerability.
How to fix CVE-2007-2756?: To fix CVE-2007-2756, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2007-2756 being actively exploited in the wild?: It is possible that CVE-2007-2756 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~6% probability that this vulnerability will be exploited by malicious actors in the next 30 days.