ID CVE-2016-10168
Summary Integer overflow in gd_io.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via vectors involving the number of horizontal and vertical chunks in an image.
References
Vulnerable Configurations
  • cpe:2.3:a:libgd:libgd:1.3.0:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:1.3.0:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:1.4.0:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:1.4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:1.5.0:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:1.5.0:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:1.6.0:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:1.6.0:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:1.6.1:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:1.6.1:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:1.6.2:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:1.6.2:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:1.6.3:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:1.6.3:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:1.7.0:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:1.7.0:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:1.7.1:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:1.7.1:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:1.7.2:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:1.7.2:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:1.7.3:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:1.7.3:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:1.8.0:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:1.8.0:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:1.8.1:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:1.8.1:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:1.8.3:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:1.8.3:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:1.8.4:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:1.8.4:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.6:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.6:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.7:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.7:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.8:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.8:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.9:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.9:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.10:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.10:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.11:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.11:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.12:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.12:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.13:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.13:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.14:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.14:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.15:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.15:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.17:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.17:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.18:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.18:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.19:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.19:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.20:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.20:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.21:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.21:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.22:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.22:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.23:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.23:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.24:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.24:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.25:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.25:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.26:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.26:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.27:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.27:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.28:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.28:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.29:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.29:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.30:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.30:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.31:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.31:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.32:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.32:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.33:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.33:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.34:rc1:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.34:rc1:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.1.0:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.1.0:-:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.1.0:-:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.1.0:alpha1:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.1.0:alpha1:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.1.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.1.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.1.0:rc2:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.1.0:rc2:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.2.0:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.2.2:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.2.3:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.2.3:*:*:*:*:*:*:*
CVSS
Base: 6.8 (as of 04-05-2018 - 01:29)
Impact:
Exploitability:
CWE CWE-190
CAPEC
  • Forced Integer Overflow
    This attack forces an integer variable to go out of range. The integer variable is often used as an offset such as size of memory allocation or similarly. The attacker would typically control the value of such variable and try to get it out of range. For instance the integer in question is incremented past the maximum possible value, it may wrap to become a very small, or negative number, therefore providing a very incorrect value which can lead to unexpected behavior. At worst the attacker can execute arbitrary code.
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:M/Au:N/C:P/I:P/A:P
redhat via4
advisories
  • bugzilla
    id 1418986
    title CVE-2016-10168 gd: Integer overflow in gd_io.c
    oval
    AND
    • OR
      • comment Red Hat Enterprise Linux 7 Client is installed
        oval oval:com.redhat.rhba:tst:20150364001
      • comment Red Hat Enterprise Linux 7 Server is installed
        oval oval:com.redhat.rhba:tst:20150364002
      • comment Red Hat Enterprise Linux 7 Workstation is installed
        oval oval:com.redhat.rhba:tst:20150364003
      • comment Red Hat Enterprise Linux 7 ComputeNode is installed
        oval oval:com.redhat.rhba:tst:20150364004
    • OR
      • AND
        • comment php is earlier than 0:5.4.16-43.el7_4
          oval oval:com.redhat.rhsa:tst:20173221015
        • comment php is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195006
      • AND
        • comment php-bcmath is earlier than 0:5.4.16-43.el7_4
          oval oval:com.redhat.rhsa:tst:20173221047
        • comment php-bcmath is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195048
      • AND
        • comment php-cli is earlier than 0:5.4.16-43.el7_4
          oval oval:com.redhat.rhsa:tst:20173221025
        • comment php-cli is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195044
      • AND
        • comment php-common is earlier than 0:5.4.16-43.el7_4
          oval oval:com.redhat.rhsa:tst:20173221041
        • comment php-common is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195010
      • AND
        • comment php-dba is earlier than 0:5.4.16-43.el7_4
          oval oval:com.redhat.rhsa:tst:20173221009
        • comment php-dba is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195054
      • AND
        • comment php-devel is earlier than 0:5.4.16-43.el7_4
          oval oval:com.redhat.rhsa:tst:20173221023
        • comment php-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195032
      • AND
        • comment php-embedded is earlier than 0:5.4.16-43.el7_4
          oval oval:com.redhat.rhsa:tst:20173221005
        • comment php-embedded is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195038
      • AND
        • comment php-enchant is earlier than 0:5.4.16-43.el7_4
          oval oval:com.redhat.rhsa:tst:20173221045
        • comment php-enchant is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195026
      • AND
        • comment php-fpm is earlier than 0:5.4.16-43.el7_4
          oval oval:com.redhat.rhsa:tst:20173221029
        • comment php-fpm is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20130514036
      • AND
        • comment php-gd is earlier than 0:5.4.16-43.el7_4
          oval oval:com.redhat.rhsa:tst:20173221043
        • comment php-gd is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195056
      • AND
        • comment php-intl is earlier than 0:5.4.16-43.el7_4
          oval oval:com.redhat.rhsa:tst:20173221019
        • comment php-intl is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195030
      • AND
        • comment php-ldap is earlier than 0:5.4.16-43.el7_4
          oval oval:com.redhat.rhsa:tst:20173221007
        • comment php-ldap is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195046
      • AND
        • comment php-mbstring is earlier than 0:5.4.16-43.el7_4
          oval oval:com.redhat.rhsa:tst:20173221039
        • comment php-mbstring is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195042
      • AND
        • comment php-mysql is earlier than 0:5.4.16-43.el7_4
          oval oval:com.redhat.rhsa:tst:20173221017
        • comment php-mysql is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195008
      • AND
        • comment php-mysqlnd is earlier than 0:5.4.16-43.el7_4
          oval oval:com.redhat.rhsa:tst:20173221031
        • comment php-mysqlnd is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20141013028
      • AND
        • comment php-odbc is earlier than 0:5.4.16-43.el7_4
          oval oval:com.redhat.rhsa:tst:20173221035
        • comment php-odbc is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195020
      • AND
        • comment php-pdo is earlier than 0:5.4.16-43.el7_4
          oval oval:com.redhat.rhsa:tst:20173221033
        • comment php-pdo is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195018
      • AND
        • comment php-pgsql is earlier than 0:5.4.16-43.el7_4
          oval oval:com.redhat.rhsa:tst:20173221027
        • comment php-pgsql is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195014
      • AND
        • comment php-process is earlier than 0:5.4.16-43.el7_4
          oval oval:com.redhat.rhsa:tst:20173221051
        • comment php-process is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195016
      • AND
        • comment php-pspell is earlier than 0:5.4.16-43.el7_4
          oval oval:com.redhat.rhsa:tst:20173221021
        • comment php-pspell is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195028
      • AND
        • comment php-recode is earlier than 0:5.4.16-43.el7_4
          oval oval:com.redhat.rhsa:tst:20173221049
        • comment php-recode is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195050
      • AND
        • comment php-snmp is earlier than 0:5.4.16-43.el7_4
          oval oval:com.redhat.rhsa:tst:20173221011
        • comment php-snmp is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195036
      • AND
        • comment php-soap is earlier than 0:5.4.16-43.el7_4
          oval oval:com.redhat.rhsa:tst:20173221013
        • comment php-soap is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195024
      • AND
        • comment php-xml is earlier than 0:5.4.16-43.el7_4
          oval oval:com.redhat.rhsa:tst:20173221053
        • comment php-xml is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195022
      • AND
        • comment php-xmlrpc is earlier than 0:5.4.16-43.el7_4
          oval oval:com.redhat.rhsa:tst:20173221037
        • comment php-xmlrpc is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110195052
    rhsa
    id RHSA-2017:3221
    released 2017-11-15
    severity Moderate
    title RHSA-2017:3221: php security update (Moderate)
  • rhsa
    id RHSA-2018:1296
rpms
  • php-0:5.4.16-43.el7_4
  • php-bcmath-0:5.4.16-43.el7_4
  • php-cli-0:5.4.16-43.el7_4
  • php-common-0:5.4.16-43.el7_4
  • php-dba-0:5.4.16-43.el7_4
  • php-devel-0:5.4.16-43.el7_4
  • php-embedded-0:5.4.16-43.el7_4
  • php-enchant-0:5.4.16-43.el7_4
  • php-fpm-0:5.4.16-43.el7_4
  • php-gd-0:5.4.16-43.el7_4
  • php-intl-0:5.4.16-43.el7_4
  • php-ldap-0:5.4.16-43.el7_4
  • php-mbstring-0:5.4.16-43.el7_4
  • php-mysql-0:5.4.16-43.el7_4
  • php-mysqlnd-0:5.4.16-43.el7_4
  • php-odbc-0:5.4.16-43.el7_4
  • php-pdo-0:5.4.16-43.el7_4
  • php-pgsql-0:5.4.16-43.el7_4
  • php-process-0:5.4.16-43.el7_4
  • php-pspell-0:5.4.16-43.el7_4
  • php-recode-0:5.4.16-43.el7_4
  • php-snmp-0:5.4.16-43.el7_4
  • php-soap-0:5.4.16-43.el7_4
  • php-xml-0:5.4.16-43.el7_4
  • php-xmlrpc-0:5.4.16-43.el7_4
refmap via4
bid 95869
confirm
debian DSA-3777
mlist
  • [oss-security] 20170126 CVE Requests: libgd: potential unsigned onderflow, denial-of-service in gdImageCreateFromGd2Ctx and signed overflow in gd_io.c
  • [oss-security] 20170128 Re: CVE Requests: libgd: potential unsigned onderflow, denial-of-service in gdImageCreateFromGd2Ctx and signed overflow in gd_io.c
sectrack 1037659
Last major update 04-05-2018 - 01:29
Published 15-03-2017 - 15:59
Back to Top