Mandriva Linux Security Advisory : gd (MDVSA-2008:038)
Low Nessus Plugin ID 37016
SynopsisThe remote Mandriva Linux host is missing one or more security updates.
DescriptionBuffer overflow in the LWZReadByte() function in gd_gif_in.c in GD prior to 2.0.34 allows remote attackers to have an unknown impact via a GIF file with input_code_size greater than MAX_LWZ_BITS, which triggers an overflow when initializing the table array.
This was originally fixed in PHP's embedded GD with MDKSA-2006:162;
patches had not been applied to the system libgd at that time.
The updated packages have been patched to correct this issue.
SolutionUpdate the affected packages.