CVE-2016-5767

HIGH

GD Graphics Library <2.0.34RC1 - DoS

Title source: llm

Description

Integer overflow in the gdImageCreate function in gd.c in the GD Graphics Library (aka libgd) before 2.0.34RC1, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted image dimensions.

References (12)

Core 12

Core References

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00004.html

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-updates/2016-08/msg00003.html

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2016-2750.html

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2016-2598.html

Release Notes x_refsource_confirm

http://php.net/ChangeLog-5.php

Release Notes mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2016/06/23/4

Release Notes x_refsource_confirm

http://php.net/ChangeLog-7.php

Vendor Advisory x_refsource_confirm

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731

Various Sources x_refsource_confirm

https://bugs.php.net/bug.php?id=72446

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00025.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/91395

Patch x_refsource_confirm

http://github.com/php/php-src/commit/c395c6e5d7e8df37a21265ff76e48fe75ceb5ae6?w=1

Scores

CVSS v3 8.8

EPSS 0.0671

EPSS Percentile 93.1%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-190

Status published

Products (1)

libgd/libgd < 2.0.33

Published Aug 07, 2016

Tracked Since Feb 18, 2026