CVE-2018-1000222 — Vulnetix

Try Vulnetix Request Demo

CVE-2018-1000222 PUBLISHED

Libgd version 2.2.5 contains a Double Free Vulnerability vulnerability in gdImageBmpPtr Function that can result in Remote Code Execution . This attack appear to be exploitable via Specially Crafted Jpeg Image can trigger double free. This vulnerability appears to have been fixed in after commit ac16bdf2d41724b5a65255d4c28fb0ec46bc42f5.

EPSS 1.21% · 78.9th percentile

Risk Scores

EPSS Score

1.21%

78.9th percentile

Affected Products

Vendor	Product	Versions
Ubuntu:14.04:LTS	libgd2	0, 2.1.0-2, 2.1.0-3
Ubuntu:18.04:LTS	libgd2	2.2.5-4, 0, 2.2.5-3
Ubuntu:16.04:LTS	libgd2	2.1.1-4ubuntu0.16.04.1, 2.1.1-4ubuntu0.16.04.2, 2.1.1-4ubuntu0.16.04.3

Timeline

Aug 20, 2018 CVE Published
Apr 14, 2021 EPSS Score
Jun 22, 2021 EPSS Score
Oct 24, 2021 EPSS Score
Dec 25, 2021 EPSS Score
Feb 4, 2022 EPSS Score
Feb 25, 2022 EPSS Score
Jun 29, 2022 EPSS Score
Aug 31, 2022 EPSS Score
Nov 1, 2022 EPSS Score
Jan 2, 2023 EPSS Score
Mar 7, 2023 EPSS Score

References

https://ubuntu.com/security/CVE-2018-1000222 third-party-advisory
https://github.com/libgd/libgd/issues/447 third-party-advisory
https://github.com/libgd/libgd/commit/ac16bdf2d41724b5a65255d4c28fb0ec46bc42f5 third-party-advisory
https://ubuntu.com/security/notices/USN-3755-1 vendor-advisory
https://www.cve.org/CVERecord?id=CVE-2018-1000222 third-party-advisory

Open in Interactive Console →