← Vulnerability feed

Vulnerability record · CVE-2004-0941 · published 9 February 2005

CVE-2004-0941: Gd graphics library gdlib vulnerability

GGd Graphics Library · Gdlib

Multiple buffer overflows in the gd graphics library (libgd) 2.0.21 and earlier may allow remote attackers to execute arbitrary code via malformed image files that trigger the overflows due to improper calls to the gdMalloc function, a different set of vulnerabilities than CVE-2004-0990.

10.0 CVSS 2.0 High EPSS 11% · top 4.3%
10.0CVSS 2.0 base score
11%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
36References
16 Jun 2026Last modified by NVD

Description

Multiple buffer overflows in the gd graphics library (libgd) 2.0.21 and earlier may allow remote attackers to execute arbitrary code via malformed image files that trigger the overflows due to improper calls to the gdMalloc function, a different set of vulnerabilities than CVE-2004-0990.

AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://secunia.com/advisories/13179/
http://secunia.com/advisories/18686
http://secunia.com/advisories/20824
http://secunia.com/advisories/21050
http://www.ciac.org/ciac/bulletins/p-071.shtml
http://www.debian.org/security/2004/dsa-601
http://www.mandriva.com/security/advisories?name=MDKSA-2006:113
http://www.mandriva.com/security/advisories?name=MDKSA-2006:114
http://www.mandriva.com/security/advisories?name=MDKSA-2006:122
http://www.redhat.com/support/errata/RHSA-2004-638.html
http://www.redhat.com/support/errata/RHSA-2006-0194.html
http://www.securityfocus.com/bid/11663 PatchVendor Advisory
http://www.trustix.org/errata/2004/0058 PatchVendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/18048
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11176
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1195
https://www.ubuntu.com/usn/usn-25-1/
https://www.ubuntu.com/usn/usn-33-1/
http://secunia.com/advisories/13179/
http://secunia.com/advisories/18686
http://secunia.com/advisories/20824
http://secunia.com/advisories/21050
http://www.ciac.org/ciac/bulletins/p-071.shtml
http://www.debian.org/security/2004/dsa-601
http://www.mandriva.com/security/advisories?name=MDKSA-2006:113
http://www.mandriva.com/security/advisories?name=MDKSA-2006:114
http://www.mandriva.com/security/advisories?name=MDKSA-2006:122
http://www.redhat.com/support/errata/RHSA-2004-638.html
http://www.redhat.com/support/errata/RHSA-2006-0194.html
http://www.securityfocus.com/bid/11663 PatchVendor Advisory
http://www.trustix.org/errata/2004/0058 PatchVendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/18048
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11176
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1195
https://www.ubuntu.com/usn/usn-25-1/
https://www.ubuntu.com/usn/usn-33-1/

Track CVE-2004-0941 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2007-0910Php vulnerabilityUnspecified vulnerability in PHP before 5.2.1 allows attackers to "clobber" certain super-global variables via unspecified vectors.EPSS 3.4%10.0CVE-2005-3625Easy software products cups vulnerabilityXpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of servic…EPSS 3.8%10.0CVE-2004-0990Gd graphics library gdlib vulnerabilityInteger overflow in GD Graphics Library libgd 2.0.28 (libgd2), and possibly other versions, allows remote attackers to cause a denial of service and …EPSS 28%10.0CVE-2004-0989Xmlsoft libxml vulnerabilityMultiple buffer overflows in libXML 2.6.12 and 2.6.13 (libxml2), and possibly other versions, may allow remote attackers to execute arbitrary code vi…EPSS 22%10.0CVE-2004-1011Carnegie mellon university cyrus imap server vulnerabilityStack-based buffer overflow in Cyrus IMAP Server 2.2.4 through 2.2.8, with the imapmagicplus option enabled, allows remote attackers to execute arbit…EPSS 5.8%10.0CVE-2004-1012Carnegie mellon university cyrus imap server vulnerabilityThe argument parser of the PARTIAL command in Cyrus IMAP Server 2.2.6 and earlier allows remote authenticated users to execute arbitrary code via a c…EPSS 6.0%10.0CVE-2004-1013Carnegie mellon university cyrus imap server vulnerabilityThe argument parser of the FETCH command in Cyrus IMAP Server 2.2.x through 2.2.8 allows remote authenticated users to execute arbitrary code via cer…EPSS 5.8%10.0CVE-2004-1019Openpkg improper input validation vulnerabilityThe deserialization code in PHP before 4.3.10 and PHP 5.x up to 5.0.2 allows remote attackers to cause a denial of service and execute arbitrary code…EPSS 8.0%

Source: NIST National Vulnerability Database (record CVE-2004-0941), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.