Re: [GD-DEVEL] 2.2.2 release, upgrade recommended

--5NS4umxuldV6B0VRPjuMB7KLPA7dxgTwH
Content-Type: multipart/mixed; boundary="WuJbLCqxSs0kALpdHI6SsN8PxTODLGUvQ"
From: Remi Collet <[email protected]>
To: [email protected]
Message-ID: <[email protected]>
Subject: Re: [GD-DEVEL] 2.2.2 release, upgrade recommended
References: <CAEZPtU5qHMmiag-9y9Xpe8T+fF+c76L5rRG41Xs0=JnQ=q=7dw@mail.gmail.com>
In-Reply-To: <CAEZPtU5qHMmiag-9y9Xpe8T+fF+c76L5rRG41Xs0=JnQ=q=7dw@mail.gmail.com>

--WuJbLCqxSs0kALpdHI6SsN8PxTODLGUvQ
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

Le 24/06/2016 =C3=A0 10:58, Pierre Joye a =C3=A9crit :
> hi,
>=20
> 2.2.2 has been released and contains numerous fixes including security =
ones.

=46rom changelog

* Integer Overflow in gdImagePaletteToTrueColor() resulting in heap
overflow (CVE-2016-5767)

	=3D> looks like the patch is already in old versions
	(checked 2.1.1)

* Integer Overflow in _gd2GetHeader() resulting in heap overflow
(CVE-2016-5766)

	=3D> fix missing (see previous mail)

* NULL Pointer Dereference at _gdScaleVert

	=3D> looks lkike the patch is already in old versions
	(checked 2.1.1)

* Integer Overflow in gdImagePaletteToTrueColor() in heap overflow

	=3D> duplicate of 1st entry ;)


Remi.



--WuJbLCqxSs0kALpdHI6SsN8PxTODLGUvQ--

--5NS4umxuldV6B0VRPjuMB7KLPA7dxgTwH
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iEYEARECAAYFAldtPrUACgkQYUppBSnxahjh7gCdFH/Om6ttzVMdxWotIPQuX5yt
/f0Ani9O8T729dRPvAmLle5xJm2qas9f
=WcX5
-----END PGP SIGNATURE-----

--5NS4umxuldV6B0VRPjuMB7KLPA7dxgTwH--