CVE-2021-40812

Published: 8 September 2021

The GD Graphics Library (aka LibGD) through 2.3.2 has an out-of-bounds read because of the lack of certain gdGetBuf and gdPutBuf return value checks.

Notes

php uses the system libgd2

the fix proposed is a partial one that address BMP and WebP
but not GIF.
no complete fix available from upstream as of 2021-11-08

still no complete fix from upstream as of 2022-11-25.

Priority

Low

CVSS 3 base score: 6.5

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40812
• https://github.com/libgd/libgd/issues/750#issuecomment-914872385
• https://github.com/libgd/libgd/issues/757
• NVD
• Launchpad
• Debian