Mandrake Linux Security Advisory : tetex (MDKSA-2006:113)
Critical Nessus Plugin ID 21770
SynopsisThe remote Mandrake Linux host is missing one or more security updates.
DescriptionInteger overflows were reported in the GD Graphics Library (libgd) 2.0.28, and possibly other versions. These overflows allow remote attackers to cause a denial of service and possibly execute arbitrary code via PNG image files with large image rows values that lead to a heap-based buffer overflow in the gdImageCreateFromPngCtx() function.
Tetex contains an embedded copy of the GD library code.
The LZW decoding in the gdImageCreateFromGifPtr function in the Thomas Boutell graphics draw (GD) library (aka libgd) 2.0.33 allows remote attackers to cause a denial of service (CPU consumption) via malformed GIF data that causes an infinite loop. Tetex contains an embedded copy of the GD library code. (CVE-2006-2906)
Updated packages have been patched to address both issues.
SolutionUpdate the affected packages.