CVE-2019-6978: Double Free
Last updated 25 August 2025
Other sources
The GD Graphics Library (aka LibGD) 2.2.5 has a double free in the gdImagePtr() functions in gdgifout.c, gdjpeg.c, and gdwbmp.c. NOTE: PHP is unaffected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/libwmfto a version that resolves this vulnerability.Fixed in 0:0.2.8.4-44.el7 - Upgrade
Upgrade
redhat/libwmfto a version that resolves this vulnerability.Fixed in 0:0.2.9-8.el8_0 - Upgrade
Upgrade
redhat/gdto a version that resolves this vulnerability.Fixed in 0:2.2.5-7.el8 - Upgrade
Upgrade
debian/libgd2to a version that resolves this vulnerability.Fixed in 2.2.5-5.1Fixed in 2.2.4-2+deb9u4 - Upgrade
Upgrade
debian/libgd2to a version that resolves this vulnerability.Fixed in 2.3.0-2Fixed in 2.3.0-2+deb11u1Fixed in 2.3.3-9Fixed in 2.3.3-13
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-6978?
CVE-2019-6978 is a vulnerability in the GD Graphics Library (LibGD) 2.2.5 that allows for a double free in the gdImage*Ptr() functions.
What is the severity of CVE-2019-6978?
The severity of CVE-2019-6978 is critical with a CVSS score of 9.8.
What software is affected by CVE-2019-6978?
The affected software includes libwmf, gd, libgd2, and various versions of Debian and Ubuntu Linux distributions.
How can I fix CVE-2019-6978?
To fix CVE-2019-6978, you should update to the recommended versions of the affected software packages.
Where can I find more information about CVE-2019-6978?
You can find more information about CVE-2019-6978 on the GitHub pages for LibGD and PHP.