ECHO-0435-d140-fc4a
See a problem?- Import Source
- https://advisory.echohq.com/osv/ECHO-0435-d140-fc4a.json
- JSON Data
- https://api.osv.dev/v1/vulns/ECHO-0435-d140-fc4a
- Upstream
- Withdrawn
- 2026-07-19T17:45:01Z
- Published
- 2026-05-24T11:13:48Z
- Modified
- 2026-09-15T03:33:35Z
- Summary
- Buffer overflow/over-read in _gdGetColors (gd_gd.c) reached via the GD-file reader (gdImageCreateFromGd) when colorsTotal is not validated (libgd 2.x / PHP before 5.3.1). libwmf uses its bundled GD only as an output backend and exposes no API that decodes an untrusted .gd file, so the vulnerable reader path is never invoked. Additionally the upstream validation is already present in this trixie source: _gdGetColors in src/extra/gd/gd_gd.c rejects colorsTotal > gdMaxColors, and the non-2x branch reads colorsTotal as a single byte (<= 255 < gdMaxColors). Not reachable and already remediated in source; scanners flag it only via Debian's stale source-package match (trixie "unimportant / unfixed"; standalone libgd2 is fixed).
- Details
- References