{"id":"ECHO-0435-d140-fc4a","upstream":["CVE-2009-3546"],"severity":[],"modified":"2026-07-19T17:45:01.763Z","affected":[{"package":{"ecosystem":"Echo","name":"libwmf"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.13-1.1"}]}]}],"references":[{"type":"WEB","url":"https://advisory.echohq.com/cve/CVE-2009-3546"}],"withdrawn":"2026-07-19T17:45:01.763Z","summary":"Buffer overflow/over-read in _gdGetColors (gd_gd.c) reached via the GD-file\nreader (gdImageCreateFromGd) when colorsTotal is not validated (libgd 2.x /\nPHP before 5.3.1). libwmf uses its bundled GD only as an output backend and\nexposes no API that decodes an untrusted .gd file, so the vulnerable reader\npath is never invoked. Additionally the upstream validation is already\npresent in this trixie source: _gdGetColors in src/extra/gd/gd_gd.c rejects\ncolorsTotal > gdMaxColors, and the non-2x branch reads colorsTotal as a\nsingle byte (<= 255 < gdMaxColors). Not reachable and already remediated in\nsource; scanners flag it only via Debian's stale source-package match\n(trixie \"unimportant / unfixed\"; standalone libgd2 is fixed).\n"}