{"id":"ECHO-966c-4616-acc0","upstream":["CVE-2007-3477"],"severity":[],"modified":"2026-07-19T17:45:01.763Z","affected":[{"package":{"ecosystem":"Echo","name":"libwmf"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.13-1.1"}]}]}],"references":[{"type":"WEB","url":"https://advisory.echohq.com/cve/CVE-2007-3477"}],"withdrawn":"2026-07-19T17:45:01.763Z","summary":"CPU-consumption DoS in gdImageArc/gdImageFilledArc (libgd before 2.0.35) via\na very large start/end angle, which drove the unbounded arc loop. The libgd\n2.0.35 fix — normalizing the angles and clamping the sweep to <= 360 before\nthe drawing loop — is already present in this trixie source: gdImageFilledArc\nin src/extra/gd/gd.c reduces s/e modulo 360 and rewinds e to s (the block\npreceding \"for (i = s; (i <= e); i++)\"), so the loop runs at most ~720\niterations regardless of the requested angle. There is nothing to backport;\nthe vulnerability does not reproduce against 0.2.13. Debian rates trixie\n\"unimportant\".\n"}