ID CVE-2016-6161
Summary The output function in gd_gif_out.c in the GD Graphics Library (aka libgd) allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted image.
References
Vulnerable Configurations
  • libgd 2.2.2
    cpe:2.3:a:libgd:libgd:2.2.2
  • Debian Linux 8.0 (Jessie)
    cpe:2.3:o:debian:debian_linux:8.0
  • openSUSE Leap 42.1
    cpe:2.3:o:opensuse:leap:42.1
CVSS
Base: 4.3 (as of 05-10-2016 - 20:53)
Impact:
Exploitability:
CWE CWE-125
CAPEC
  • Overread Buffers
    An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
nessus via4
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2016-1108.NASL
    description This update for gd fixes the following issues : - CVE-2016-6214: Buffer over-read issue when parsing crafted TGA file [bsc#991436] - CVE-2016-6132: read out-of-bands was found in the parsing of TGA files using libgd [bsc#987577] - CVE-2016-6128: Invalid color index not properly handled [bsc#991710] - CVE-2016-6207: Integer overflow error within _gdContributionsAlloc() [bsc#991622] - CVE-2016-6161: global out of bounds read when encoding gif from malformed input withgd2togif [bsc#988032] - CVE-2016-5116: avoid stack overflow (read) with large names [bsc#982176] - CVE-2016-6905: Out-of-bounds read in function read_image_tga in gd_tga.c [bsc#995034] This update was imported from the SUSE:SLE-12:Update update project.
    last seen 2019-02-21
    modified 2016-10-13
    plugin id 93701
    published 2016-09-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=93701
    title openSUSE Security Update : gd (openSUSE-2016-1108)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-3030-1.NASL
    description It was discovered that the GD library incorrectly handled memory when using gdImageScaleTwoPass(). A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2013-7456) It was discovered that the GD library incorrectly handled certain malformed XBM images. If a user or automated system were tricked into processing a specially crafted XBM image, an attacker could cause a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 15.10 and Ubuntu 16.04 LTS. (CVE-2016-5116) It was discovered that the GD library incorrectly handled memory when using _gd2GetHeader(). A remote attacker could possibly use this issue to cause a denial of service or possibly execute arbitrary code. (CVE-2016-5766) It was discovered that the GD library incorrectly handled certain color indexes. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 15.10 and Ubuntu 16.04 LTS. (CVE-2016-6128) It was discovered that the GD library incorrectly handled memory when encoding a GIF image. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2016-6161). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 92011
    published 2016-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=92011
    title Ubuntu 12.04 LTS / 14.04 LTS / 15.10 / 16.04 LTS : libgd2 vulnerabilities (USN-3030-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2016-2460-1.NASL
    description This update for php7 fixes the following security issues : - CVE-2016-6128: Invalid color index not properly handled [bsc#987580] - CVE-2016-6161: global out of bounds read when encoding gif from malformed input withgd2togif [bsc#988032] - CVE-2016-6292: NULL pointer dereference in exif_process_user_comment [bsc#991422] - CVE-2016-6295: Use after free in SNMP with GC and unserialize() [bsc#991424] - CVE-2016-6297: Stack-based buffer overflow vulnerability in php_stream_zip_opener [bsc#991426] - CVE-2016-6291: Out-of-bounds access in exif_process_IFD_in_MAKERNOTE [bsc#991427] - CVE-2016-6289: Integer overflow leads to buffer overflow in virtual_file_ex [bsc#991428] - CVE-2016-6290: Use after free in unserialize() with Unexpected Session Deserialization [bsc#991429] - CVE-2016-5399: Improper error handling in bzread() [bsc#991430] - CVE-2016-6296: Heap buffer overflow vulnerability in simplestring_addn in simplestring.c [bsc#991437] - CVE-2016-6207: Integer overflow error within _gdContributionsAlloc() [bsc#991434] - CVE-2016-4473: Invalid free() instead of efree() in phar_extract_file() - CVE-2016-7124: Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization - CVE-2016-7125: PHP Session Data Injection Vulnerability - CVE-2016-7126: select_colors write out-of-bounds - CVE-2016-7127: imagegammacorrect allowed arbitrary write access - CVE-2016-7128: Memory Leakage In exif_process_IFD_in_TIFF - CVE-2016-7129: wddx_deserialize allowed illegal memory access - CVE-2016-7131: wddx_deserialize null dereference with invalid xml - CVE-2016-7132: wddx_deserialize null dereference in php_wddx_pop_element - CVE-2016-7133: memory allocator fails to realloc small block to large one - CVE-2016-7134: Heap overflow in the function curl_escape - CVE-2016-7130: wddx_deserialize null dereference - CVE-2016-7413: Use after free in wddx_deserialize - CVE-2016-7412: Heap overflow in mysqlnd when not receiving UNSIGNED_FLAG in BIT field - CVE-2016-7417: Missing type check when unserializing SplArray - CVE-2016-7416: Stack based buffer overflow in msgfmt_format_message - CVE-2016-7418: NULL pointer dereference in php_wddx_push_element - CVE-2016-7414: Out of bounds heap read when verifying signature of zip phar in phar_parse_zipfile Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2019-01-02
    plugin id 119981
    published 2019-01-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=119981
    title SUSE SLES12 Security Update : php7 (SUSE-SU-2016:2460-1)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DLA-563.NASL
    description A global out of bounds read when encoding gif from malformed input was found in this software. When given invalid inputs, we might be fed the EOF marker before it is actually the EOF. The gif logic assumes once it sees the EOF marker, there won't be any more data, so it leaves the cur_bits index possibly negative. So when we get more data, we underflow the masks array. For Debian 7 'Wheezy', these problems have been fixed in version 2.0.36~rc1~dfsg-6.1+deb7u5. We recommend that you upgrade your libgd2 packages. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-07-09
    plugin id 92570
    published 2016-07-27
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=92570
    title Debian DLA-563-1 : libgd2 security update
  • NASL family F5 Networks Local Security Checks
    NASL id F5_BIGIP_SOL71581599.NASL
    description The output function in gd_gif_out.c in the GD Graphics Library (aka libgd) allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted image. (CVE-2016-6161)
    last seen 2019-02-21
    modified 2019-01-04
    plugin id 94923
    published 2016-11-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=94923
    title F5 Networks BIG-IP : libgd vulnerability (K71581599)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2016-0DE0E0EE0C.NASL
    description Security fix for gd. ---- Security fix for CVE-2016-6161 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2016-10-18
    plugin id 93872
    published 2016-10-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=93872
    title Fedora 23 : gd (2016-0de0e0ee0c)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2016-2302-1.NASL
    description This update for gd fixes the following issues : - security update : - CVE-2016-6161: global out of bounds read when encoding gif from malformed input withgd2togif [bsc#988032] Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-29
    plugin id 93505
    published 2016-09-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=93505
    title SUSE SLES11 Security Update : gd (SUSE-SU-2016:2302-1)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-3619.NASL
    description Several vulnerabilities were discovered in libgd2, a library for programmatic graphics creation and manipulation. A remote attacker can take advantage of these flaws to cause a denial-of-service against an application using the libgd2 library (application crash), or potentially to execute arbitrary code with the privileges of the user running the application.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 92327
    published 2016-07-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=92327
    title Debian DSA-3619-1 : libgd2 - security update
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2016-1003.NASL
    description This update for gd fixes the following issues : - CVE-2016-6214: Buffer over-read issue when parsing crafted TGA file [bsc#991436] - CVE-2016-6132: read out-of-bands was found in the parsing of TGA files using libgd [bsc#987577] - CVE-2016-6128: Invalid color index not properly handled [bsc#991710] - CVE-2016-6207: Integer overflow error within _gdContributionsAlloc() [bsc#991622] - CVE-2016-6161: global out of bounds read when encoding gif from malformed input withgd2togif [bsc#988032]
    last seen 2019-02-21
    modified 2016-10-13
    plugin id 93063
    published 2016-08-22
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=93063
    title openSUSE Security Update : gd (openSUSE-2016-1003)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2016-1156.NASL
    description This update for php5 fixes the following security issues : - CVE-2016-6128: Invalid color index not properly handled [bsc#987580] - CVE-2016-6161: global out of bounds read when encoding gif from malformed input withgd2togif [bsc#988032] - CVE-2016-6292: NULL pointer dereference in exif_process_user_comment [bsc#991422] - CVE-2016-6295: Use after free in SNMP with GC and unserialize() [bsc#991424] - CVE-2016-6297: Stack-based buffer overflow vulnerability in php_stream_zip_opener [bsc#991426] - CVE-2016-6291: Out-of-bounds access in exif_process_IFD_in_MAKERNOTE [bsc#991427] - CVE-2016-6289: Integer overflow leads to buffer overflow in virtual_file_ex [bsc#991428] - CVE-2016-6290: Use after free in unserialize() with Unexpected Session Deserialization [bsc#991429] - CVE-2016-5399: Improper error handling in bzread() [bsc#991430] - CVE-2016-6296: Heap buffer overflow vulnerability in simplestring_addn in simplestring.c [bsc#991437] - CVE-2016-6207: Integer overflow error within _gdContributionsAlloc() [bsc#991434] - CVE-2014-3587: Integer overflow in the cdf_read_property_info affecting SLES11 SP3 [bsc#987530] - CVE-2016-6288: Buffer over-read in php_url_parse_ex [bsc#991433] - CVE-2016-7124: Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization - CVE-2016-7125: PHP Session Data Injection Vulnerability - CVE-2016-7126: select_colors write out-of-bounds - CVE-2016-7127: imagegammacorrect allowed arbitrary write access - CVE-2016-7128: Memory Leakage In exif_process_IFD_in_TIFF - CVE-2016-7129: wddx_deserialize allowed illegal memory access - CVE-2016-7130: wddx_deserialize null dereference - CVE-2016-7131: wddx_deserialize null dereference with invalid xml - CVE-2016-7132: wddx_deserialize null dereference in php_wddx_pop_element - CVE-2016-7134: Heap overflow in the function curl_escape This update was imported from the SUSE:SLE-12:Update update project.
    last seen 2019-02-21
    modified 2016-10-13
    plugin id 93856
    published 2016-10-05
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=93856
    title openSUSE Security Update : php5 (openSUSE-2016-1156)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2016-2408-1.NASL
    description This update for php5 fixes the following security issues : - CVE-2016-6128: Invalid color index not properly handled [bsc#987580] - CVE-2016-6161: global out of bounds read when encoding gif from malformed input withgd2togif [bsc#988032] - CVE-2016-6292: NULL pointer dereference in exif_process_user_comment [bsc#991422] - CVE-2016-6295: Use after free in SNMP with GC and unserialize() [bsc#991424] - CVE-2016-6297: Stack-based buffer overflow vulnerability in php_stream_zip_opener [bsc#991426] - CVE-2016-6291: Out-of-bounds access in exif_process_IFD_in_MAKERNOTE [bsc#991427] - CVE-2016-6289: Integer overflow leads to buffer overflow in virtual_file_ex [bsc#991428] - CVE-2016-6290: Use after free in unserialize() with Unexpected Session Deserialization [bsc#991429] - CVE-2016-5399: Improper error handling in bzread() [bsc#991430] - CVE-2016-6296: Heap buffer overflow vulnerability in simplestring_addn in simplestring.c [bsc#991437] - CVE-2016-6207: Integer overflow error within _gdContributionsAlloc() [bsc#991434] - CVE-2014-3587: Integer overflow in the cdf_read_property_info affecting SLES11 SP3 [bsc#987530] - CVE-2016-6288: Buffer over-read in php_url_parse_ex [bsc#991433] - CVE-2016-7124: Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization - CVE-2016-7125: PHP Session Data Injection Vulnerability - CVE-2016-7126: select_colors write out-of-bounds - CVE-2016-7127: imagegammacorrect allowed arbitrary write access - CVE-2016-7128: Memory Leakage In exif_process_IFD_in_TIFF - CVE-2016-7129: wddx_deserialize allowed illegal memory access - CVE-2016-7130: wddx_deserialize null dereference - CVE-2016-7131: wddx_deserialize null dereference with invalid xml - CVE-2016-7132: wddx_deserialize null dereference in php_wddx_pop_element - CVE-2016-7134: Heap overflow in the function curl_escape Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2019-01-02
    plugin id 119979
    published 2019-01-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=119979
    title SUSE SLES12 Security Update : php5 (SUSE-SU-2016:2408-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2016-2303-1.NASL
    description This update for gd fixes the following issues : - CVE-2016-6214: Buffer over-read issue when parsing crafted TGA file [bsc#991436] - CVE-2016-6132: read out-of-bands was found in the parsing of TGA files using libgd [bsc#987577] - CVE-2016-6128: Invalid color index not properly handled [bsc#991710] - CVE-2016-6207: Integer overflow error within _gdContributionsAlloc() [bsc#991622] - CVE-2016-6161: global out of bounds read when encoding gif from malformed input withgd2togif [bsc#988032] - CVE-2016-5116: avoid stack overflow (read) with large names [bsc#982176] - CVE-2016-6905: Out-of-bounds read in function read_image_tga in gd_tga.c [bsc#995034] Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-29
    plugin id 93506
    published 2016-09-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=93506
    title SUSE SLED12 / SLES12 Security Update : gd (SUSE-SU-2016:2303-1)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2016-985.NASL
    description This update for php5 fixes the following issues : - security update : - CVE-2016-6128: Invalid color index not properly handled [bsc#987580] - CVE-2016-6161: global out of bounds read when encoding gif from malformed input withgd2togif [bsc#988032] - CVE-2016-6292: NULL pointer dereference in exif_process_user_comment [bsc#991422] - CVE-2016-6295: Use after free in SNMP with GC and unserialize() [bsc#991424] - CVE-2016-6297: Stack-based buffer overflow vulnerability in php_stream_zip_opener [bsc#991426] - CVE-2016-6291: Out-of-bounds access in exif_process_IFD_in_MAKERNOTE [bsc#991427] - CVE-2016-6289: Integer overflow leads to buffer overflow in virtual_file_ex [bsc#991428] - CVE-2016-6290: Use after free in unserialize() with Unexpected Session Deserialization [bsc#991429] - CVE-2016-5399: Improper error handling in bzread() [bsc#991430] - CVE-2016-6296: Heap buffer overflow vulnerability in simplestring_addn in simplestring.c [bsc#991437] - CVE-2016-6207: Integer overflow error within _gdContributionsAlloc() [bsc#991434] - CVE-2016-6288: Buffer over-read in php_url_parse_ex [bsc#991433]
    last seen 2019-02-21
    modified 2016-10-13
    plugin id 92982
    published 2016-08-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=92982
    title openSUSE Security Update : php5 (openSUSE-2016-985)
refmap via4
confirm https://github.com/libgd/libgd/issues/209
debian DSA-3619
mlist
  • [oss-security] 20160705 CVE Request: libgd: global out of bounds read when encoding gif from malformed input with gd2togif
  • [oss-security] 20160705 Re: CVE Request: libgd: global out of bounds read when encoding gif from malformed input with gd2togif
suse
  • openSUSE-SU-2016:2117
  • openSUSE-SU-2016:2363
ubuntu USN-3030-1
Last major update 28-11-2016 - 15:30
Published 12-08-2016 - 11:59
Last modified 30-10-2018 - 12:27
Back to Top