Detections
Analytics
Alpine: libgd, multiple gd packages: security update to 2.2.5-r2
critical Tenable Cloud Security Plugin ID 423929
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.33, 7.0.x before 7.0.27,
7.1.x before 7.1.13, and 7.2.x before 7.2.1, has an integer signedness error that leads to an infinite
loop via a crafted GIF file, as demonstrated by a call to the imagecreatefromgif or imagecreatefromstring
PHP function. This is related to GetCode_ and gdImageCreateFromGifCtx. (CVE-2018-5711)
- gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the
imagecolormatch function in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before
7.3.1, has a heap-based buffer overflow. This can be exploited by an attacker who is able to trigger
imagecolormatch calls with crafted image data. (CVE-2019-6977)
- The GD Graphics Library (aka LibGD) 2.2.5 has a double free in the gdImage*Ptr() functions in
gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c. NOTE: PHP is unaffected. (CVE-2019-6978)
See Also
https://security.alpinelinux.org/vuln/CVE-2018-5711
Plugin Details
Severity: Critical
ID: 423929
Version: Revision 1.8
Type: Local
Published: 4/4/2025
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.12
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.9
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2019-6978
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 11/25/2017