ID CVE-2016-6132
Summary The gdImageCreateFromTgaCtx function in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.
References
Vulnerable Configurations
  • libgd 2.2.2
    cpe:2.3:a:libgd:libgd:2.2.2
  • Debian Linux 8.0 (Jessie)
    cpe:2.3:o:debian:debian_linux:8.0
  • openSUSE Leap 42.1
    cpe:2.3:o:opensuse:leap:42.1
CVSS
Base: 4.3 (as of 05-10-2016 - 20:53)
Impact:
Exploitability:
CWE CWE-125
CAPEC
  • Overread Buffers
    An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
nessus via4
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-3060-1.NASL
    description It was discovered that the GD library incorrectly handled certain malformed TGA images. If a user or automated system were tricked into processing a specially crafted TGA image, an attacker could cause a denial of service. (CVE-2016-6132, CVE-2016-6214) It was discovered that the GD library incorrectly handled memory when using gdImageScale(). A remote attacker could possibly use this issue to cause a denial of service or possibly execute arbitrary code. (CVE-2016-6207). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 92869
    published 2016-08-11
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=92869
    title Ubuntu 14.04 LTS / 16.04 LTS : libgd2 vulnerabilities (USN-3060-1)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2016-1108.NASL
    description This update for gd fixes the following issues : - CVE-2016-6214: Buffer over-read issue when parsing crafted TGA file [bsc#991436] - CVE-2016-6132: read out-of-bands was found in the parsing of TGA files using libgd [bsc#987577] - CVE-2016-6128: Invalid color index not properly handled [bsc#991710] - CVE-2016-6207: Integer overflow error within _gdContributionsAlloc() [bsc#991622] - CVE-2016-6161: global out of bounds read when encoding gif from malformed input withgd2togif [bsc#988032] - CVE-2016-5116: avoid stack overflow (read) with large names [bsc#982176] - CVE-2016-6905: Out-of-bounds read in function read_image_tga in gd_tga.c [bsc#995034] This update was imported from the SUSE:SLE-12:Update update project.
    last seen 2019-02-21
    modified 2016-10-13
    plugin id 93701
    published 2016-09-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=93701
    title openSUSE Security Update : gd (openSUSE-2016-1108)
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_556D22865A5111E6A6C314DAE9D210B8.NASL
    description Pierre Joye reports : - fix php bug 72339, Integer Overflow in _gd2GetHeader (CVE-2016-5766) - gd: Buffer over-read issue when parsing crafted TGA file (CVE-2016-6132) - Integer overflow error within _gdContributionsAlloc() (CVE-2016-6207) - fix php bug 72494, invalid color index not handled, can lead to crash ( CVE-2016-6128)
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 92740
    published 2016-08-05
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=92740
    title FreeBSD : gd -- multiple vulnerabilities (556d2286-5a51-11e6-a6c3-14dae9d210b8)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2016-615F3BF06E.NASL
    description **LibGD 2.2.3 release** Security related fixes: This flaw is caused by loading data from external sources (file, custom ctx, etc) and are hard to validate before calling libgd APIs : - fix php bug php#72339, Integer Overflow in _gd2GetHeader (CVE-2016-5766) - bug #248, fix Out-Of-Bounds Read in read_image_tga Using application provided parameters, in these cases invalid data causes the issues : - Integer overflow error within _gdContributionsAlloc() (CVE-2016-6207) - fix php bug php#72494, invalid color index not handled, can lead to crash - improve color check for CropThreshold Important update : - gdImageCopyResampled has been improved. Better handling of images with alpha channel, also brings libgd in sync with php's bundled gd. This is a recommended update. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2016-10-18
    plugin id 92532
    published 2016-07-25
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=92532
    title Fedora 24 : gd (2016-615f3bf06e)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-3619.NASL
    description Several vulnerabilities were discovered in libgd2, a library for programmatic graphics creation and manipulation. A remote attacker can take advantage of these flaws to cause a denial-of-service against an application using the libgd2 library (application crash), or potentially to execute arbitrary code with the privileges of the user running the application.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 92327
    published 2016-07-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=92327
    title Debian DSA-3619-1 : libgd2 - security update
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2016-1003.NASL
    description This update for gd fixes the following issues : - CVE-2016-6214: Buffer over-read issue when parsing crafted TGA file [bsc#991436] - CVE-2016-6132: read out-of-bands was found in the parsing of TGA files using libgd [bsc#987577] - CVE-2016-6128: Invalid color index not properly handled [bsc#991710] - CVE-2016-6207: Integer overflow error within _gdContributionsAlloc() [bsc#991622] - CVE-2016-6161: global out of bounds read when encoding gif from malformed input withgd2togif [bsc#988032]
    last seen 2019-02-21
    modified 2016-10-13
    plugin id 93063
    published 2016-08-22
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=93063
    title openSUSE Security Update : gd (openSUSE-2016-1003)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2016-2303-1.NASL
    description This update for gd fixes the following issues : - CVE-2016-6214: Buffer over-read issue when parsing crafted TGA file [bsc#991436] - CVE-2016-6132: read out-of-bands was found in the parsing of TGA files using libgd [bsc#987577] - CVE-2016-6128: Invalid color index not properly handled [bsc#991710] - CVE-2016-6207: Integer overflow error within _gdContributionsAlloc() [bsc#991622] - CVE-2016-6161: global out of bounds read when encoding gif from malformed input withgd2togif [bsc#988032] - CVE-2016-5116: avoid stack overflow (read) with large names [bsc#982176] - CVE-2016-6905: Out-of-bounds read in function read_image_tga in gd_tga.c [bsc#995034] Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-29
    plugin id 93506
    published 2016-09-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=93506
    title SUSE SLED12 / SLES12 Security Update : gd (SUSE-SU-2016:2303-1)
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201612-09.NASL
    description The remote host is affected by the vulnerability described in GLSA-201612-09 (GD: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in GD. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could possibly execute arbitrary code with the privileges of the process, or cause a Denial of Service condition. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2016-12-05
    plugin id 95524
    published 2016-12-05
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=95524
    title GLSA-201612-09 : GD: Multiple vulnerabilities
refmap via4
bid 91520
confirm
debian DSA-3619
gentoo GLSA-201612-09
mlist
  • [oss-security] 20160630 CVE Request: A read out-of-bands was found in the parsing of TGA files using libgd
  • [oss-security] 20160630 Re: CVE Request: A read out-of-bands was found in the parsing of TGA files using libgd
suse
  • openSUSE-SU-2016:2117
  • openSUSE-SU-2016:2363
ubuntu USN-3060-1
Last major update 28-11-2016 - 15:30
Published 12-08-2016 - 11:59
Last modified 30-10-2018 - 12:27
Back to Top