CVE-2014-9709: canonical ubuntu_linux
Vulnerability summary
CVE-2014-9709 is a medium (CVSS 5.0) vulnerability in canonical ubuntu_linux. EPSS estimates a 15.43% chance of exploitation in the next 30 days, higher than 96.7% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 10 · Related 4Timeline
- 30-03-2015PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The GetCode_ function in gd_gif_in.c in GD 2.1.1 and earlier, as used in PHP before 5.5.21 and 5.6.x before 5.6.5, allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted GIF image that is improperly handled by the gdImageCreateFromGif function.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
15.43%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
No change 0.00 pp
From 15.43% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (php.net)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.
Suse5 products
- gd&distro=SUSE Linux Enterprise Desktop 12< 2.1.0-5.1
- gd&distro=SUSE Linux Enterprise Server 12< 2.1.0-5.1
- gd&distro=SUSE Linux Enterprise Server for SAP Applications 12< 2.1.0-5.1
- gd&distro=SUSE Linux Enterprise Software Development Kit 12< 2.1.0-5.1
- gd&distro=SUSE Linux Enterprise Workstation Extension 12< 2.1.0-5.1
Debian2 products
- libgd2< 2.1.0-5
- debian_linuxEOL7.0 | 8.0
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04 | 15.10 | 16.04
Libgd1 product
- libgd≤ 2.1.1
Opensuse1 product
- opensuseEOL13.1 | 13.2
Php1 product
- php≥ 5.4.0, < 5.4.40 | ≥ 5.5.0, < 5.5.21 | ≥ 5.6.0, < 5.6.5
Ubuntu1 product
- libgd2< 2.1.0-3ubuntu0.1
7 vendors · 12 products
References
31 links- www.mandriva.com/security/advisories?name=MDVSA-2015:153Vendor AdvisoryX Refsource MANDRIVAThird Party Advisory
- lists.opensuse.org/opensuse-updates/2015-04/msg00002.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.apple.com/archives/security-announce/2015/Sep/msg00008.htmlVendor AdvisoryX Refsource APPLEMailing ListThird Party Advisory
- bitbucket.org/libgd/gd-libgd/commits/47eb44b2e90ca88a08dca9f9a1aa9041e9587f43X Refsource CONFIRMThird Party Advisory
- www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlX Refsource CONFIRMThird Party Advisory
- marc.info?l=bugtraq&m=143403519711434&w=2Vendor AdvisoryX Refsource HPMailing ListThird Party Advisory
Show all 31 references
- lists.opensuse.org/opensuse-security-announce/2015-05/msg00005.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.htmlX Refsource CONFIRMThird Party Advisory
- bugzilla.suse.com/923945REPORT