Debian alert DSA-6409-1 (libgd2)

From:
             
 
Salvatore Bonaccorso <carnil@debian.org>
To:
             
 
debian-security-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DSA 6409-1] libgd2 security update
Date:
             
 
Sat, 01 Aug 2026 09:24:47 +0000
Message-ID:
             
 
<E1wq5xX-00000002KC5-229d@seger.debian.org>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-6409-1                   security@debian.org
https://www.debian.org/security/                     Salvatore Bonaccorso
August 01, 2026                       https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : libgd2
CVE ID         : CVE-2026-9672
Debian Bug     : 1143151

A vulnerability was discovered in libgd2, a library for programmatic
graphics creation and manipulation, which may result in denial of
service or potentially the execution of arbitrary code if a malformed
GIF file is processed.

For the stable distribution (trixie), this problem has been fixed in
version 2.3.3-14~deb13u1.

We recommend that you upgrade your libgd2 packages.

For the detailed security status of libgd2 please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/libgd2

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmptuz9fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0ScOQ/+IwZMBiWdgyP5UrqjftQ2uSfvJ27WabEDw/L1IDSUPUpal1HvzN84xplf
SkH5NsscLzMtNE4a5U12NH6mtCfSI0b8bqRqaerWYQ1gvh8Iyt1mo7Ika5+0vlwS
pswTFTdgN0by+oKxOViPeXOabvVKHKDSPEkn9j/1NwqSZA/f2zaK4Oh1siqqBRYe
WBbPnmduMySlZ55CuIvEu4WXI0rfqRG8Pek9hDVWyKCHPZZ4xvKVwd4Su0JoAYbQ
Q0x9Z3idk7mdEUGCgb9fmr5O/i8e2X4A/e3GbxDSidxKrHAkr5b/rkZrtXdq4wOn
EHgyJow6x7kjITK4GymF14vI1HSIFGk41L+T9ARQ5KOXnY/JA864JIMlZj7MKKTr
FJHiDCTnOHaXZwORFBDQUzbofDgWUKwfu6U96cF5VEeiTrva3LZQ/AuIAkdalBdp
NR8h7PWmT1pLlgaTbEdhEcn2y6ukrywpUAtaY5TFhdn6F2zgi7OUiOhGWiEI8olW
Uj2LUuix40Vzqb04kDu+u8V+poajpClIru+s0Xr83Cq4/4q6izTPJf4K31C70eZE
VhfIqYpnC9QCQSoX1x5fCobeQSSPTwaBBgL5L1TIhEnhFHjvem8N1fcdDx0RnbVv
PG3Cw0C9G/AvV9CUXuUT2xQu3XWMWNaZFkNeOaYdJSK6Q9LHvKM=
=3XPO
-----END PGP SIGNATURE-----