The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The GD Graphics Library (aka LibGD) 2.2.5 has a double free in the gdImage*Ptr() functions in     gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c. NOTE: PHP is unaffected. (CVE-2019-6978)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2022:0054 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2018-14553:
    gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a NULL pointer dereference allowing attackers to     crash an application via a specific function call sequence. Only affects PHP when linked with an external     libgd (not bundled).

    CVE-2019-6977:
    gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the     imagecolormatch function in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1, has a heap-based buffer overflow. This can be exploited by an attacker who is able to trigger     imagecolormatch calls with crafted image data.

    CVE-2019-6978:
    The GD Graphics Library (aka LibGD) 2.2.5 has a double free in the gdImage*Ptr() functions in     gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c. NOTE: PHP is unaffected.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-3943 advisory.

    - Resolves: rhbz#1679005 CVE-2019-6978

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Several issues in libgd2, a graphics library that allows to quickly draw images, have been found.

CVE-2019-6977 A potential double free in gdImage*Ptr() has been reported by Solmaz Salimi (aka. Rooney).

CVE-2019-6978 Simon Scannell found a heap-based buffer overflow, exploitable with crafted image data.

CVE-2018-1000222 A new double free vulnerabilities in gdImageBmpPtr() has been reported by Solmaz Salimi (aka. Rooney).

CVE-2018-5711 Due to an integer signedness error the GIF core parsing function can enter an infinite loop. This will lead to a Denial of Service and exhausted server resources.

For Debian 8 'Jessie', these problems have been fixed in version 2.1.0-5+deb8u12.

We recommend that you upgrade your libgd2 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php7 fixes the following issues :

Security issue fixed :

CVE-2019-6977: Fixed a heap-based buffer overflow the GD Graphics Library used in the imagecolormatch function (bsc#1123354).

CVE-2019-6978: Fixed a double free in the gdImage*Ptr() functions (bsc#1123522).

CVE-2018-19935: Fixed a Denial of Service in php_imap.c which could be triggered via an empty string in the message argument to imap_mail (bsc#1118832).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 6.02, has gd packages installed that are affected by multiple vulnerabilities:

  - The GD Graphics Library (aka LibGD) 2.2.5 has a double free in the gdImage*Ptr() functions in     gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c. NOTE: PHP is unaffected. (CVE-2019-6978)

  - gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the     imagecolormatch function in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1, has a heap-based buffer overflow. This can be exploited by an attacker who is able to trigger     imagecolormatch calls with crafted image data. (CVE-2019-6977)

  - gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a NULL pointer dereference allowing attackers to     crash an application via a specific function call sequence. Only affects PHP when linked with an external     libgd (not bundled). (CVE-2018-14553)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4659 advisory.

  - gd: NULL pointer dereference in gdImageClone (CVE-2018-14553)

  - gd: Heap-based buffer overflow in gdImageColorMatch() in gd_color_match.c (CVE-2019-6977)

  - gd: Double free in the gdImage*Ptr in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c (CVE-2019-6978)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLED_SAP12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1560-1 advisory.

    libwmf was updated to 0.2.12:

    * upstream changed to fork from Fedora: https://github.com/caolanm/libwmf
    * merged all the pending fixes
    * merge in fixes for libgd CVE-2019-6978 (bsc#1123522)
    * fixed memory allocation failure (CVE-2016-9011)

    * Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2019_2722 advisory.

    * gd: double free in the gdImage*Ptr in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c (CVE-2019-6978)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
223075	Linux Distros Unpatched Vulnerability : CVE-2019-6978	Nessus	Misc.	3/4/2025	7/31/2026	critical
276393	TencentOS Server 3: gd (TSSA-2022:0054)	Nessus	Tencent Local Security Checks	11/20/2025	11/20/2025	critical
141232	Oracle Linux 7 : libwmf (ELSA-2020-3943)	Nessus	Oracle Linux Local Security Checks	10/7/2020	10/22/2024	critical
121483	Debian DLA-1651-1 : libgd2 security update	Nessus	Debian Local Security Checks	1/31/2019	6/25/2024	critical
122146	SUSE SLES12 Security Update : php7 (SUSE-SU-2019:0333-1)	Nessus	SuSE Local Security Checks	2/13/2019	6/20/2024	critical
147709	NewStart CGSL MAIN 6.02 : gd Multiple Vulnerabilities (NS-SA-2021-0066)	Nessus	NewStart CGSL Local Security Checks	3/11/2021	3/12/2021	critical
145893	CentOS 8 : gd (CESA-2020:4659)	Nessus	CentOS Local Security Checks	2/1/2021	3/23/2021	critical
160716	SUSE SLED12 / SLES12 Security Update : libwmf (SUSE-SU-2022:1560-1)	Nessus	SuSE Local Security Checks	5/7/2022	6/26/2026	critical
357044	Rocky Linux 8 [CIQ] Security Update: libwmf / libwmf-debuginfo / libwmf-debugsource / libwmf-devel / etc (crlsa-2019_2722)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/1/2026	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical