UnratedFix available
libgd2 — security advisory
Multiple integer overflows in the (1) createwbmp and (2) readwbmp functions in wbmp.c in the GD library (libgd) in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allow context-dependent attackers to execute arbitrary code via Wireless Bitmap (WBMP) images with large width or height values.
- Products
- libgd2
- Affected versions
- Not specified
- Fixed versions
- 2.0.33-1
- CVEs
- CVE-2007-1001
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 15:45 UTC · Revision 1
Source evidence
Multiple integer overflows in the (1) createwbmp and (2) readwbmp functions in wbmp.c in the GD library (libgd) in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allow context-dependent attackers to execute arbitrary code via Wireless Bitmap (WBMP) images with large width or height values.
osv:DEBIAN-CVE-2007-1001
libgd2
Fixed versions: 2.0.33-1
libgd2
Fixed versions: 2.0.33-1
libgd2
Fixed versions: 2.0.33-1
Complete source record
{
"id": "0a7c8d9c77444a5874d1e3f3758aaf7a9371430e0ecfb15a630b66bb5bf18747",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2007-1001",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2007-1001",
"summary": "Multiple integer overflows in the (1) createwbmp and (2) readwbmp functions in wbmp.c in the GD library (libgd) in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allow context-dependent attackers to execute arbitrary code via Wireless Bitmap (WBMP) images with large width or height values.",
"evidence": "osv:DEBIAN-CVE-2007-1001",
"products": [
{
"name": {
"value": "libgd2",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.0.33-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libgd2",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.0.33-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libgd2",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.0.33-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "DEBIAN-CVE-2007-1001",
"aliases": [
"DEBIAN-CVE-2007-1001"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.33-1"
}
]
}
],
"package": {
"name": "libgd2",
"purl": "pkg:deb/debian/libgd2?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2007-1001.json"
},
"ecosystem_specific": {
"urgency": "medium"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.33-1"
}
]
}
],
"package": {
"name": "libgd2",
"purl": "pkg:deb/debian/libgd2?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2007-1001.json"
},
"ecosystem_specific": {
"urgency": "medium"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.33-1"
}
]
}
],
"package": {
"name": "libgd2",
"purl": "pkg:deb/debian/libgd2?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2007-1001.json"
},
"ecosystem_specific": {
"urgency": "medium"
}
}
],
"modified": "2026-10-21T17:47:35.350619031Z",
"provider": "osv",
"upstream": [
"CVE-2007-1001"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2007-1001"
]
},
"related_cves": [
{
"value": "CVE-2007-1001",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 398326,
"published_at": "2007-04-06T00:19:00+00:00"
}