Web Browser 로는 FTP 접속이 불가능 합니다.

문서번호 : 1204636143
업데이트 : 2008.03.04


상세내용

- 보안버그 수정 사항

. CVE-2006-4484
Buffer overflow in the LWZReadByte_ function in ext/gd/libgd/gd_gif_in.c in the
GD extension in PHP before 5.1.5 allows remote attackers to have an unknown
impact via a GIF file with input_code_size greater than MAX_LWZ_BITS, which
triggers an overflow when initializing the table array.

. CVE-2007-0455
Buffer overflow in the gdImageStringFTEx function in gdft.c in GD Graphics
Library 2.0.33 and earlier allows remote attackers to cause a denial of
service (application crash) and possibly execute arbitrary code via a crafted
string with a JIS encoded font.

. CVE-2007-2756
The gdPngReadData function in libgd 2.0.34 allows user-assisted attackers to
cause a denial of service (CPU consumption) via a crafted PNG image with
truncated data, which causes an infinite loop in the png_read_info function
in libpng.

. CVE-2007-3472
Integer overflow in gdImageCreateTrueColor function in the GD Graphics Library
(libgd) before 2.0.35 allows user-assisted remote attackers to have unspecified
attack vectors and impact.

. CVE-2007-3473
The gdImageCreateXbm function in the GD Graphics Library (libgd) before 2.0.35
allows user-assisted remote attackers to cause a denial of service (crash) via
unspecified vectors involving a gdImageCreate failure.

. CVE-2007-3475
The GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote
attackers to cause a denial of service (crash) via a GIF image that has no
global color map.

. CVE-2007-3476
Array index error in gd_gif_in.c in the GD Graphics Library (libgd) before
2.0.35 allows user-assisted remote attackers to cause a denial of service
(crash and heap corruption) via large color index values in crafted image
data, which results in a segmentation fault.


Autoupdates 지원 : 지원


update 패키지

  RPMS :

    . gd-2.0.28-5.4.1.i686.rpm
    . gd-progs-2.0.28-5.4.1.i686.rpm
    . gd-devel-2.0.28-5.4.1.i686.rpm

  SRPMS :

    . gd-2.0.28-5.4.1.src.rpm


참고 :
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4484
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0455
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2756
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3472
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3473
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3475
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3476