CVE-2016-5767

Integer overflow in the gdImageCreate function in gd.c in the GD Graphics Library (aka libgd) before 2.0.34RC1, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted image dimensions.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 89%
Affected Products (NVD)
VendorProductVersion
libgdlibgd
𝑥
≤ 2.0.33
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
libgd2
bookworm
2.3.3-9
fixed
bullseye
2.3.0-2
fixed
sid
2.3.3-12
fixed
trixie
2.3.3-12
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libgd2
precise
not-affected
trusty
not-affected
wily
not-affected
xenial
not-affected
php5
precise
not-affected
trusty
not-affected
wily
not-affected
xenial
dne
php7.0
precise
dne
trusty
dne
wily
dne
xenial
not-affected
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
php
RHEL 7
0:5.4.16-42.el7
fixed
php-bcmath
RHEL 7
0:5.4.16-42.el7
fixed
php-cli
RHEL 7
0:5.4.16-42.el7
fixed
php-common
RHEL 7
0:5.4.16-42.el7
fixed
php-dba
RHEL 7
0:5.4.16-42.el7
fixed
php-devel
RHEL 7
0:5.4.16-42.el7
fixed
php-embedded
RHEL 7
0:5.4.16-42.el7
fixed
php-enchant
RHEL 7
0:5.4.16-42.el7
fixed
php-fpm
RHEL 7
0:5.4.16-42.el7
fixed
php-gd
RHEL 7
0:5.4.16-42.el7
fixed
php-intl
RHEL 7
0:5.4.16-42.el7
fixed
php-ldap
RHEL 7
0:5.4.16-42.el7
fixed
php-mbstring
RHEL 7
0:5.4.16-42.el7
fixed
php-mysql
RHEL 7
0:5.4.16-42.el7
fixed
php-mysqlnd
RHEL 7
0:5.4.16-42.el7
fixed
php-odbc
RHEL 7
0:5.4.16-42.el7
fixed
php-pdo
RHEL 7
0:5.4.16-42.el7
fixed
php-pgsql
RHEL 7
0:5.4.16-42.el7
fixed
php-process
RHEL 7
0:5.4.16-42.el7
fixed
php-pspell
RHEL 7
0:5.4.16-42.el7
fixed
php-recode
RHEL 7
0:5.4.16-42.el7
fixed
php-snmp
RHEL 7
0:5.4.16-42.el7
fixed
php-soap
RHEL 7
0:5.4.16-42.el7
fixed
php-xml
RHEL 7
0:5.4.16-42.el7
fixed
php-xmlrpc
RHEL 7
0:5.4.16-42.el7
fixed
Common Weakness Enumeration
References
http://github.com/php/php-src/commit/c395c6e5d7e8df37a21265ff76e48fe75ceb5ae6?w=1
http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00004.html
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00025.html
http://lists.opensuse.org/opensuse-updates/2016-08/msg00003.html
http://php.net/ChangeLog-5.php
http://php.net/ChangeLog-7.php
http://rhn.redhat.com/errata/RHSA-2016-2598.html
http://rhn.redhat.com/errata/RHSA-2016-2750.html
http://www.openwall.com/lists/oss-security/2016/06/23/4
http://www.securityfocus.com/bid/91395
https://bugs.php.net/bug.php?id=72446
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731
http://github.com/php/php-src/commit/c395c6e5d7e8df37a21265ff76e48fe75ceb5ae6?w=1
http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00004.html
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00025.html
http://lists.opensuse.org/opensuse-updates/2016-08/msg00003.html
http://php.net/ChangeLog-5.php
http://php.net/ChangeLog-7.php
http://rhn.redhat.com/errata/RHSA-2016-2598.html
http://rhn.redhat.com/errata/RHSA-2016-2750.html
http://www.openwall.com/lists/oss-security/2016/06/23/4
http://www.securityfocus.com/bid/91395
https://bugs.php.net/bug.php?id=72446
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731