CVE-2018-14553: Canonical Ubuntu Linux

High severity, CVSS 7.5. EPSS: 3.4% chance of exploitation in the next 30 days.

gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a NULL pointer dereference allowing attackers to crash an application via a specific function call sequence. Only affects PHP when linked with an external libgd (not bundled).

Affected products

• Canonical Ubuntu Linux: version 14.04 only; version 16.04 only; version 18.04 only; version 19.10 only
• Debian Debian Linux: version 8.0 only
• Fedoraproject Fedora: version 32 only
• Libgd Libgd: from 2.1.1, up to and including 2.2.5; version 2.1.0 only
• Opensuse Leap: version 15.1 only

Published 2020-02-11. Last modified 2026-06-17.