Latest release

LibGD 2.2.4

@oerdnj oerdnj released this Jan 18, 2017 · 326 commits to master since this release

LibGD team is proud to announce the 2.2.4 release of libgd.

Security related fixes:
This flaw is caused by loading data from external sources (file, custom ctx, etc) and are hard to validate before calling libgd APIs:

  • gdImageCreate() doesn't check for oversized images and as such is
    prone to DoS vulnerabilities. (CVE-2016-9317)
  • double-free in gdImageWebPtr() (CVE-2016-6912)
  • potential unsigned underflow in gd_interpolation.c
  • DOS vulnerability in gdImageCreateFromGd2Ctx()
  • Signed Integer Overflow gd_io.c

For full list of changes, see CHANGELOG.md.

This is a recommended update.

Check out the full commits list since the previous release.

Downloads

gd-2.2.3

@pierrejoye pierrejoye released this Jul 22, 2016 · 326 commits to master since this release

We welcome the 2.2.3 release around a month after 2.2.2 (we are getting consistent). Another important
milestone in the GD 2.2 series.

Security related fixes:
This flaw is caused by loading data from external sources (file, custom ctx, etc) and are hard to validate before calling libgd APIs:

  • fix php bug 72339, Integer Overflow in _gd2GetHeader (CVE-2016-5766)
  • bug #248, fix Out-Of-Bounds Read in read_image_tga
  • gd: Buffer over-read issue when parsing crafted TGA file (CVE-2016-6132)

Using application provided parameters, in these cases invalid data causes the issues:

  • Integer overflow error within _gdContributionsAlloc() (CVE-2016-6207)
  • fix php bug 72494, invalid color index not handled, can lead to crash ( CVE-2016-6128)
  • improve color check for CropThreshold

Important update

  • gdImageCopyResampled has been improved. Better handling of images with alpha channel, also brings libgd in sync with php's bundled gd.

Numerous other fixes have been applied. The scale and rotation functions have been greatly improved as well.

This is a recommended update.

On a sidenote, we have now a gitter channel if you have any questions or like to discuss with us, in addition to our "#libgd" freenode channel:
Chat

Issues fixed in this release:
https://github.com/libgd/libgd/issues?q=is%3Aissue+milestone%3AGD-2.2.3+is%3Aclosed

You can download the 2.2.3 version of GD Graphics Library from here or using tag:

https://github.com/libgd/libgd/releases/tag/gd-2.2.3

Full commits list since 2.2.2
gd-2.2.2...gd-2.2.3

Downloads

gd-2.2.2

@pierrejoye pierrejoye released this Jun 24, 2016 · 326 commits to master since this release

Exactly a month after 2.2.1 we welcome the 2.2.2 release. An important
milestone in the GD 2.2 series.

Security related fixes:

  • Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow (CVE-2016-5767)
  • #215 Stack overflow with gdImageFillToBorder (CVE-2015-8874)
  • NULL Pointer Dereference at _gdScaleVert

We also like to mention to consider the GD and GD2 image formats only for development or testing
purposes. We do plan to deprecate it in GD 2.3 and remove it in GD 3.0. Its existence is not justified
anymore as other formats provide lossless storage for both palette and truecolor images in a much more
efficient way.

Numerous other fixes have been applied. The scale and rotation functions have been greatly improved as well.

This is a recommended update.

Issues fixed in this release:
https://github.com/libgd/libgd/issues?q=milestone%3A%22GD+2.2.2%22+is%3Aclosed

You can download the 2.2.2 version of GD Graphics Library from here or using tag:

https://github.com/libgd/libgd/releases/tag/gd-2.2.2

Full commits list since 2.2.1
gd-2.2.1...gd-2.2.2

Downloads

gd-2.2.0

@vapier vapier released this May 20, 2016 · 402 commits to master since this release

Mostly bugfixes including some security issues.

Downloads