CVE-2016-5766

Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via crafted chunk dimensions in an image.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 94%
Affected Products (NVD)
VendorProductVersion
redhatopenshift
2.0
freebsdfreebsd
8.3
redhatenterprise_linux
6.0
freebsdfreebsd
8.0
libgdlibgd
2.2.2
freebsdfreebsd
10.0
debiandebian_linux
8.0
freebsdfreebsd
10.1
freebsdfreebsd
8.4
freebsdfreebsd
9.2
freebsdfreebsd
8.2
freebsdfreebsd
8.1
freebsdfreebsd
9.0
freebsdfreebsd
10.2
freebsdfreebsd
9.3
redhatenterprise_linux
7.0
freebsdfreebsd
10.3
freebsdfreebsd
9.1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
libgd2
bookworm
2.3.3-9
fixed
bullseye
2.3.0-2
fixed
sid
2.3.3-12
fixed
trixie
2.3.3-12
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libgd2
precise
Fixed 2.0.36~rc1~dfsg-6ubuntu2.2
released
trusty
Fixed 2.1.0-3ubuntu0.2
released
wily
Fixed 2.1.1-4ubuntu0.15.10.2
released
xenial
Fixed 2.1.1-4ubuntu0.16.04.2
released
php5
precise
not-affected
trusty
not-affected
wily
not-affected
xenial
dne
php7.0
precise
dne
trusty
dne
wily
dne
xenial
not-affected
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
gd
suse enterprise desktop 15
2.2.5-2.22
fixed
suse enterprise desktop 15 SP1
2.2.5-4.6.1
fixed
suse enterprise desktop 15 SP2
2.2.5-9.1
fixed
suse enterprise sap 15
2.2.5-2.22
fixed
suse enterprise sap 15 SP1
2.2.5-4.6.1
fixed
suse enterprise sap 15 SP2
2.2.5-9.1
fixed
suse enterprise server 15
2.2.5-2.22
fixed
suse enterprise server 15 SP1
2.2.5-4.6.1
fixed
suse enterprise server 15 SP2
2.2.5-9.1
fixed
gd-devel
suse enterprise desktop 15
2.2.5-2.22
fixed
suse enterprise desktop 15 SP1
2.2.5-4.6.1
fixed
suse enterprise desktop 15 SP2
2.2.5-9.1
fixed
suse enterprise desktop 15 SP3
2.2.5-9.1
fixed
suse enterprise desktop 15 SP4
2.2.5-11.3.1
fixed
suse enterprise desktop 15 SP5
2.2.5-11.3.1
fixed
suse enterprise desktop 15 SP6
2.2.5-11.3.1
fixed
suse enterprise desktop 15 SP7
2.2.5-11.3.1
fixed
suse enterprise sap 15
2.2.5-2.22
fixed
suse enterprise sap 15 SP1
2.2.5-4.6.1
fixed
suse enterprise sap 15 SP2
2.2.5-9.1
fixed
suse enterprise sap 15 SP3
2.2.5-9.1
fixed
suse enterprise sap 15 SP4
2.2.5-11.3.1
fixed
suse enterprise sap 15 SP5
2.2.5-11.3.1
fixed
suse enterprise sap 15 SP6
2.2.5-11.3.1
fixed
suse enterprise sap 15 SP7
2.2.5-11.3.1
fixed
suse enterprise server 15
2.2.5-2.22
fixed
suse enterprise server 15 SP1
2.2.5-4.6.1
fixed
suse enterprise server 15 SP2
2.2.5-9.1
fixed
suse enterprise server 15 SP3
2.2.5-9.1
fixed
suse enterprise server 15 SP4
2.2.5-11.3.1
fixed
suse enterprise server 15 SP5
2.2.5-11.3.1
fixed
suse enterprise server 15 SP6
2.2.5-11.3.1
fixed
suse enterprise server 15 SP7
2.2.5-11.3.1
fixed
libgd3
suse enterprise desktop 15 SP3
2.2.5-9.1
fixed
suse enterprise desktop 15 SP4
2.2.5-11.3.1
fixed
suse enterprise desktop 15 SP5
2.2.5-11.3.1
fixed
suse enterprise desktop 15 SP6
2.2.5-11.3.1
fixed
suse enterprise desktop 15 SP7
2.2.5-11.3.1
fixed
suse enterprise sap 15 SP3
2.2.5-9.1
fixed
suse enterprise sap 15 SP4
2.2.5-11.3.1
fixed
suse enterprise sap 15 SP5
2.2.5-11.3.1
fixed
suse enterprise sap 15 SP6
2.2.5-11.3.1
fixed
suse enterprise sap 15 SP7
2.2.5-11.3.1
fixed
suse enterprise server 15 SP3
2.2.5-9.1
fixed
suse enterprise server 15 SP4
2.2.5-11.3.1
fixed
suse enterprise server 15 SP5
2.2.5-11.3.1
fixed
suse enterprise server 15 SP6
2.2.5-11.3.1
fixed
suse enterprise server 15 SP7
2.2.5-11.3.1
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
gd
RHEL 7
0:2.0.35-27.el7_9
fixed
gd-devel
RHEL 7
0:2.0.35-27.el7_9
fixed
gd-progs
RHEL 7
0:2.0.35-27.el7_9
fixed
php
RHEL 7
0:5.4.16-42.el7
fixed
php-bcmath
RHEL 7
0:5.4.16-42.el7
fixed
php-cli
RHEL 7
0:5.4.16-42.el7
fixed
php-common
RHEL 7
0:5.4.16-42.el7
fixed
php-dba
RHEL 7
0:5.4.16-42.el7
fixed
php-devel
RHEL 7
0:5.4.16-42.el7
fixed
php-embedded
RHEL 7
0:5.4.16-42.el7
fixed
php-enchant
RHEL 7
0:5.4.16-42.el7
fixed
php-fpm
RHEL 7
0:5.4.16-42.el7
fixed
php-gd
RHEL 7
0:5.4.16-42.el7
fixed
php-intl
RHEL 7
0:5.4.16-42.el7
fixed
php-ldap
RHEL 7
0:5.4.16-42.el7
fixed
php-mbstring
RHEL 7
0:5.4.16-42.el7
fixed
php-mysql
RHEL 7
0:5.4.16-42.el7
fixed
php-mysqlnd
RHEL 7
0:5.4.16-42.el7
fixed
php-odbc
RHEL 7
0:5.4.16-42.el7
fixed
php-pdo
RHEL 7
0:5.4.16-42.el7
fixed
php-pgsql
RHEL 7
0:5.4.16-42.el7
fixed
php-process
RHEL 7
0:5.4.16-42.el7
fixed
php-pspell
RHEL 7
0:5.4.16-42.el7
fixed
php-recode
RHEL 7
0:5.4.16-42.el7
fixed
php-snmp
RHEL 7
0:5.4.16-42.el7
fixed
php-soap
RHEL 7
0:5.4.16-42.el7
fixed
php-xml
RHEL 7
0:5.4.16-42.el7
fixed
php-xmlrpc
RHEL 7
0:5.4.16-42.el7
fixed
Common Weakness Enumeration
References
http://github.com/php/php-src/commit/7722455726bec8c53458a32851d2a87982cf0eac?w=1
http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00004.html
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00025.html
http://lists.opensuse.org/opensuse-updates/2016-08/msg00003.html
http://php.net/ChangeLog-5.php
http://php.net/ChangeLog-7.php
http://rhn.redhat.com/errata/RHSA-2016-2598.html
http://rhn.redhat.com/errata/RHSA-2016-2750.html
http://www.debian.org/security/2016/dsa-3619
http://www.openwall.com/lists/oss-security/2016/06/23/4
http://www.ubuntu.com/usn/USN-3030-1
https://bugs.php.net/bug.php?id=72339
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731
https://libgd.github.io/release-2.2.3.html
https://security.gentoo.org/glsa/201612-09
http://github.com/php/php-src/commit/7722455726bec8c53458a32851d2a87982cf0eac?w=1
http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00004.html
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00025.html
http://lists.opensuse.org/opensuse-updates/2016-08/msg00003.html
http://php.net/ChangeLog-5.php
http://php.net/ChangeLog-7.php
http://rhn.redhat.com/errata/RHSA-2016-2598.html
http://rhn.redhat.com/errata/RHSA-2016-2750.html
http://www.debian.org/security/2016/dsa-3619
http://www.openwall.com/lists/oss-security/2016/06/23/4
http://www.ubuntu.com/usn/USN-3030-1
https://bugs.php.net/bug.php?id=72339
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731
https://libgd.github.io/release-2.2.3.html
https://security.gentoo.org/glsa/201612-09