Kees Cook has reported a vulnerability in GD Graphics Library, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to an error within the "gdImageStringFTEx()" function in gdft.c, which can be exploited to increment the terminating NULL of a string, potentially resulting in a buffer overflow.

Successful exploitation requires that a JIS-encoded font is used.

Solution
Do not use JIS-encoded fonts with an application using GD Graphics Library.

Provided and/or discovered by
Kees Cook

Original Advisory
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=224607

Deep Links
Links available to Secunia VIM customers