Synopsis

gd security update

Type/Severity

Security Advisory: Moderate

Topic

Updated gd packages that fix several buffer overflow flaws are now available.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

Description

The gd package contains a graphics library used for the dynamic creation of
images such as PNG and JPEG.

Several buffer overflow flaws were found in the way gd allocates memory.
An attacker could create a carefully crafted image that could execute
arbitrary code if opened by a victim using a program linked against the gd
library. The Common Vulnerabilities and Exposures project (cve.mitre.org)
assigned the name CVE-2004-0941 to these issues.

Users of gd should upgrade to these updated packages, which contain a
backported patch and is not vulnerable to these issues.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc

Fixes

• BZ - 175413 - CVE-2004-0941 additional overflows in gd

CVEs

• CVE-2004-0941

References

(none)

Red Hat Enterprise Linux Server 4

SRPM
gd-2.0.28-4.4E.1.src.rpm	SHA-256: 9075715959d6e75f97b08872268d1d455f0d9c388b8364cc85d25db1bce5a1c7
x86_64
gd-2.0.28-4.4E.1.i386.rpm	SHA-256: 39c51c75ce2422373e1e160fc541311efee30c73bf673912a215c5ce537426e5
gd-2.0.28-4.4E.1.i386.rpm	SHA-256: 39c51c75ce2422373e1e160fc541311efee30c73bf673912a215c5ce537426e5
gd-2.0.28-4.4E.1.x86_64.rpm	SHA-256: 3a7e0ec02f1e169e988a2e35a96969f49cf2f9e896f97b153b1990cfe6ec75f8
gd-2.0.28-4.4E.1.x86_64.rpm	SHA-256: 3a7e0ec02f1e169e988a2e35a96969f49cf2f9e896f97b153b1990cfe6ec75f8
gd-devel-2.0.28-4.4E.1.x86_64.rpm	SHA-256: 038ebecb844038dd83a3144f97afedc0b0b7488f28440b37bcbcec89eec5fe1e
gd-devel-2.0.28-4.4E.1.x86_64.rpm	SHA-256: 038ebecb844038dd83a3144f97afedc0b0b7488f28440b37bcbcec89eec5fe1e
gd-progs-2.0.28-4.4E.1.x86_64.rpm	SHA-256: a648a1412f0d2018e04d26147d7bb209732c413686fec71f4ae9a04713688eda
gd-progs-2.0.28-4.4E.1.x86_64.rpm	SHA-256: a648a1412f0d2018e04d26147d7bb209732c413686fec71f4ae9a04713688eda
ia64
gd-2.0.28-4.4E.1.i386.rpm	SHA-256: 39c51c75ce2422373e1e160fc541311efee30c73bf673912a215c5ce537426e5
gd-2.0.28-4.4E.1.i386.rpm	SHA-256: 39c51c75ce2422373e1e160fc541311efee30c73bf673912a215c5ce537426e5
gd-2.0.28-4.4E.1.ia64.rpm	SHA-256: dffa47f4125b511282868476950fc7f937e53b5bcbfcc7b9522f581464805e10
gd-2.0.28-4.4E.1.ia64.rpm	SHA-256: dffa47f4125b511282868476950fc7f937e53b5bcbfcc7b9522f581464805e10
gd-devel-2.0.28-4.4E.1.ia64.rpm	SHA-256: 30c43d31f613ac9a0fc34cb432f65a6676a85dd5746b26d3678d0fa41fe3b51b
gd-devel-2.0.28-4.4E.1.ia64.rpm	SHA-256: 30c43d31f613ac9a0fc34cb432f65a6676a85dd5746b26d3678d0fa41fe3b51b
gd-progs-2.0.28-4.4E.1.ia64.rpm	SHA-256: 4f72e06324a6d6628fb295e2c909ff3055956b38c0c0aa9f832cb5f3b5614815
gd-progs-2.0.28-4.4E.1.ia64.rpm	SHA-256: 4f72e06324a6d6628fb295e2c909ff3055956b38c0c0aa9f832cb5f3b5614815
i386
gd-2.0.28-4.4E.1.i386.rpm	SHA-256: 39c51c75ce2422373e1e160fc541311efee30c73bf673912a215c5ce537426e5
gd-2.0.28-4.4E.1.i386.rpm	SHA-256: 39c51c75ce2422373e1e160fc541311efee30c73bf673912a215c5ce537426e5
gd-devel-2.0.28-4.4E.1.i386.rpm	SHA-256: 8d396bab6847aa78054eaca7b4aa91b90300b50f57cf7c11a77d1e13224c91b0
gd-devel-2.0.28-4.4E.1.i386.rpm	SHA-256: 8d396bab6847aa78054eaca7b4aa91b90300b50f57cf7c11a77d1e13224c91b0
gd-progs-2.0.28-4.4E.1.i386.rpm	SHA-256: 1ba49b75c33ff5ca79713d614cba7b9de8f1e94ed19600f87205ec14550eeaf9
gd-progs-2.0.28-4.4E.1.i386.rpm	SHA-256: 1ba49b75c33ff5ca79713d614cba7b9de8f1e94ed19600f87205ec14550eeaf9

Red Hat Enterprise Linux Workstation 4

SRPM
gd-2.0.28-4.4E.1.src.rpm	SHA-256: 9075715959d6e75f97b08872268d1d455f0d9c388b8364cc85d25db1bce5a1c7
x86_64
gd-2.0.28-4.4E.1.i386.rpm	SHA-256: 39c51c75ce2422373e1e160fc541311efee30c73bf673912a215c5ce537426e5
gd-2.0.28-4.4E.1.x86_64.rpm	SHA-256: 3a7e0ec02f1e169e988a2e35a96969f49cf2f9e896f97b153b1990cfe6ec75f8
gd-devel-2.0.28-4.4E.1.x86_64.rpm	SHA-256: 038ebecb844038dd83a3144f97afedc0b0b7488f28440b37bcbcec89eec5fe1e
gd-progs-2.0.28-4.4E.1.x86_64.rpm	SHA-256: a648a1412f0d2018e04d26147d7bb209732c413686fec71f4ae9a04713688eda
ia64
gd-2.0.28-4.4E.1.i386.rpm	SHA-256: 39c51c75ce2422373e1e160fc541311efee30c73bf673912a215c5ce537426e5
gd-2.0.28-4.4E.1.ia64.rpm	SHA-256: dffa47f4125b511282868476950fc7f937e53b5bcbfcc7b9522f581464805e10
gd-devel-2.0.28-4.4E.1.ia64.rpm	SHA-256: 30c43d31f613ac9a0fc34cb432f65a6676a85dd5746b26d3678d0fa41fe3b51b
gd-progs-2.0.28-4.4E.1.ia64.rpm	SHA-256: 4f72e06324a6d6628fb295e2c909ff3055956b38c0c0aa9f832cb5f3b5614815
i386
gd-2.0.28-4.4E.1.i386.rpm	SHA-256: 39c51c75ce2422373e1e160fc541311efee30c73bf673912a215c5ce537426e5
gd-devel-2.0.28-4.4E.1.i386.rpm	SHA-256: 8d396bab6847aa78054eaca7b4aa91b90300b50f57cf7c11a77d1e13224c91b0
gd-progs-2.0.28-4.4E.1.i386.rpm	SHA-256: 1ba49b75c33ff5ca79713d614cba7b9de8f1e94ed19600f87205ec14550eeaf9

Red Hat Enterprise Linux Desktop 4

SRPM
gd-2.0.28-4.4E.1.src.rpm	SHA-256: 9075715959d6e75f97b08872268d1d455f0d9c388b8364cc85d25db1bce5a1c7
x86_64
gd-2.0.28-4.4E.1.i386.rpm	SHA-256: 39c51c75ce2422373e1e160fc541311efee30c73bf673912a215c5ce537426e5
gd-2.0.28-4.4E.1.x86_64.rpm	SHA-256: 3a7e0ec02f1e169e988a2e35a96969f49cf2f9e896f97b153b1990cfe6ec75f8
gd-devel-2.0.28-4.4E.1.x86_64.rpm	SHA-256: 038ebecb844038dd83a3144f97afedc0b0b7488f28440b37bcbcec89eec5fe1e
gd-progs-2.0.28-4.4E.1.x86_64.rpm	SHA-256: a648a1412f0d2018e04d26147d7bb209732c413686fec71f4ae9a04713688eda
i386
gd-2.0.28-4.4E.1.i386.rpm	SHA-256: 39c51c75ce2422373e1e160fc541311efee30c73bf673912a215c5ce537426e5
gd-devel-2.0.28-4.4E.1.i386.rpm	SHA-256: 8d396bab6847aa78054eaca7b4aa91b90300b50f57cf7c11a77d1e13224c91b0
gd-progs-2.0.28-4.4E.1.i386.rpm	SHA-256: 1ba49b75c33ff5ca79713d614cba7b9de8f1e94ed19600f87205ec14550eeaf9

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
gd-2.0.28-4.4E.1.src.rpm	SHA-256: 9075715959d6e75f97b08872268d1d455f0d9c388b8364cc85d25db1bce5a1c7
s390x
gd-2.0.28-4.4E.1.s390.rpm	SHA-256: 583de1c1eb19e61e589560058018eb68bb99b76ec4b7574cf057c2e5640dcc05
gd-2.0.28-4.4E.1.s390x.rpm	SHA-256: 3f9dbff48800b0d244d702ba0799e6f2e70cfa01a9e79790a4b4e6b79b1ae62c
gd-devel-2.0.28-4.4E.1.s390x.rpm	SHA-256: 0e6cc81e09b02485cb401b28cb9b82215ab89af8df64da0af7ccfe087fa8365b
gd-progs-2.0.28-4.4E.1.s390x.rpm	SHA-256: d59305f09bf4456cec948b5ed2e35d7fef45fbbf08a50386f9d209ba19750fd9
s390
gd-2.0.28-4.4E.1.s390.rpm	SHA-256: 583de1c1eb19e61e589560058018eb68bb99b76ec4b7574cf057c2e5640dcc05
gd-devel-2.0.28-4.4E.1.s390.rpm	SHA-256: 0436cc4b706485399b978447eb6363289cc4ebcdff8c2b0041f1be1fb5a4b641
gd-progs-2.0.28-4.4E.1.s390.rpm	SHA-256: a77ad33f3ccaf99cbd8f772723591aa927c7c7cd5cc46babd2b54d168ae56997

Red Hat Enterprise Linux for Power, big endian 4

SRPM
gd-2.0.28-4.4E.1.src.rpm	SHA-256: 9075715959d6e75f97b08872268d1d455f0d9c388b8364cc85d25db1bce5a1c7
ppc
gd-2.0.28-4.4E.1.ppc.rpm	SHA-256: fd33ee4f060ba2c0cdecc3fb36890352ea52c0203d7e40900b243b9e5ab2a007
gd-2.0.28-4.4E.1.ppc64.rpm	SHA-256: e559a856ea78fac4cc92e49e89df8b482776dc4193c49dfe08eb9d7b7479de4a
gd-devel-2.0.28-4.4E.1.ppc.rpm	SHA-256: 17e46ae68b2b8620580bec8f657713e8159c4cb3393e61003be39b01a3975009
gd-progs-2.0.28-4.4E.1.ppc.rpm	SHA-256: 05613b8173041bcbf5d1cfe40e23c390b4add4d4a43c7089c38be75e37ff4671