A flaw was found in gd as shipped with Fedora. Cloning a image with style "attached", triggers a NULL pointer dereference in 'gdImageClone' leading to denial of service.
Affected versions: gd-2.2.5 gd-2.2.4 gd-2.2.3 gd-2.2.2 gd-2.2.1 gd-2.2.0 gd-2.1.1 gd-2.1.0 gd-2.1.0-rc2
References:
https://bugzilla.redhat.com/showbug.cgi?id=1599032
Possible buffer read overflow was fixed upstream [1]. This was also reported against PHP: https://bugs.php.net/bug.php?id=68601 (bug is private, fixed in PHP 5.6.5)
[1]: https://bitbucket.org/libgd/gd-libgd/commits/47eb44b2e90ca88a08dca9f9a1aa9041e9587f43