ID CVE-2016-5767
Summary Integer overflow in the gdImageCreate function in gd.c in the GD Graphics Library (aka libgd) before 2.0.34RC1, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted image dimensions.
References
Vulnerable Configurations
  • cpe:2.3:a:libgd:libgd:1.3.0:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:1.3.0:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:1.4.0:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:1.4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:1.5.0:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:1.5.0:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:1.6.0:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:1.6.0:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:1.6.1:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:1.6.1:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:1.6.2:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:1.6.2:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:1.6.3:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:1.6.3:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:1.7.0:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:1.7.0:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:1.7.1:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:1.7.1:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:1.7.2:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:1.7.2:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:1.7.3:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:1.7.3:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:1.8.0:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:1.8.0:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:1.8.1:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:1.8.1:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:1.8.3:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:1.8.3:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:1.8.4:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:1.8.4:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.6:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.6:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.7:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.7:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.8:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.8:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.9:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.9:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.10:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.10:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.11:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.11:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.12:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.12:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.13:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.13:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.14:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.14:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.15:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.15:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.17:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.17:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.18:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.18:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.19:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.19:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.20:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.20:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.21:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.21:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.22:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.22:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.23:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.23:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.24:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.24:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.25:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.25:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.26:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.26:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.27:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.27:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.28:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.28:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.29:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.29:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.30:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.30:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.31:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.31:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.32:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.32:*:*:*:*:*:*:*
  • cpe:2.3:a:libgd:libgd:2.0.33:*:*:*:*:*:*:*
    cpe:2.3:a:libgd:libgd:2.0.33:*:*:*:*:*:*:*
  • cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
  • cpe:2.3:a:php:php:5.6.0:alpha1:*:*:*:*:*:*
    cpe:2.3:a:php:php:5.6.0:alpha1:*:*:*:*:*:*
  • cpe:2.3:a:php:php:5.6.0:alpha2:*:*:*:*:*:*
    cpe:2.3:a:php:php:5.6.0:alpha2:*:*:*:*:*:*
  • cpe:2.3:a:php:php:5.6.0:alpha3:*:*:*:*:*:*
    cpe:2.3:a:php:php:5.6.0:alpha3:*:*:*:*:*:*
  • cpe:2.3:a:php:php:5.6.0:alpha4:*:*:*:*:*:*
    cpe:2.3:a:php:php:5.6.0:alpha4:*:*:*:*:*:*
  • cpe:2.3:a:php:php:5.6.0:alpha5:*:*:*:*:*:*
    cpe:2.3:a:php:php:5.6.0:alpha5:*:*:*:*:*:*
  • cpe:2.3:a:php:php:5.6.0:beta1:*:*:*:*:*:*
    cpe:2.3:a:php:php:5.6.0:beta1:*:*:*:*:*:*
  • cpe:2.3:a:php:php:5.6.0:beta2:*:*:*:*:*:*
    cpe:2.3:a:php:php:5.6.0:beta2:*:*:*:*:*:*
  • cpe:2.3:a:php:php:5.6.0:beta3:*:*:*:*:*:*
    cpe:2.3:a:php:php:5.6.0:beta3:*:*:*:*:*:*
  • cpe:2.3:a:php:php:5.6.0:beta4:*:*:*:*:*:*
    cpe:2.3:a:php:php:5.6.0:beta4:*:*:*:*:*:*
  • cpe:2.3:a:php:php:5.6.1:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:5.6.1:*:*:*:*:*:*:*
  • cpe:2.3:a:php:php:5.6.2:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:5.6.2:*:*:*:*:*:*:*
  • cpe:2.3:a:php:php:5.6.3:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:5.6.3:*:*:*:*:*:*:*
  • cpe:2.3:a:php:php:5.6.4:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:5.6.4:*:*:*:*:*:*:*
  • cpe:2.3:a:php:php:5.6.5:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:5.6.5:*:*:*:*:*:*:*
  • cpe:2.3:a:php:php:5.6.6:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:5.6.6:*:*:*:*:*:*:*
  • cpe:2.3:a:php:php:5.6.7:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:5.6.7:*:*:*:*:*:*:*
  • cpe:2.3:a:php:php:5.6.8:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:5.6.8:*:*:*:*:*:*:*
  • cpe:2.3:a:php:php:5.6.9:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:5.6.9:*:*:*:*:*:*:*
  • cpe:2.3:a:php:php:5.6.10:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:5.6.10:*:*:*:*:*:*:*
  • cpe:2.3:a:php:php:5.6.11:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:5.6.11:*:*:*:*:*:*:*
  • cpe:2.3:a:php:php:5.6.12:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:5.6.12:*:*:*:*:*:*:*
  • cpe:2.3:a:php:php:5.6.13:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:5.6.13:*:*:*:*:*:*:*
  • cpe:2.3:a:php:php:5.6.14:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:5.6.14:*:*:*:*:*:*:*
  • cpe:2.3:a:php:php:5.6.15:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:5.6.15:*:*:*:*:*:*:*
  • cpe:2.3:a:php:php:5.6.16:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:5.6.16:*:*:*:*:*:*:*
  • cpe:2.3:a:php:php:5.6.17:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:5.6.17:*:*:*:*:*:*:*
  • cpe:2.3:a:php:php:5.6.18:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:5.6.18:*:*:*:*:*:*:*
  • cpe:2.3:a:php:php:5.6.19:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:5.6.19:*:*:*:*:*:*:*
  • cpe:2.3:a:php:php:5.6.20:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:5.6.20:*:*:*:*:*:*:*
  • cpe:2.3:a:php:php:5.6.21:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:5.6.21:*:*:*:*:*:*:*
  • cpe:2.3:a:php:php:5.6.22:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:5.6.22:*:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.0.6:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.0.6:*:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.0.7:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.0.7:*:*:*:*:*:*:*
CVSS
Base: 6.8 (as of 05-01-2018 - 02:31)
Impact:
Exploitability:
CWE CWE-190
CAPEC
  • Forced Integer Overflow
    This attack forces an integer variable to go out of range. The integer variable is often used as an offset such as size of memory allocation or similarly. The attacker would typically control the value of such variable and try to get it out of range. For instance the integer in question is incremented past the maximum possible value, it may wrap to become a very small, or negative number, therefore providing a very incorrect value which can lead to unexpected behavior. At worst the attacker can execute arbitrary code.
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:M/Au:N/C:P/I:P/A:P
redhat via4
advisories
  • rhsa
    id RHSA-2016:2598
  • rhsa
    id RHSA-2016:2750
rpms
  • php-0:5.4.16-42.el7
  • php-bcmath-0:5.4.16-42.el7
  • php-cli-0:5.4.16-42.el7
  • php-common-0:5.4.16-42.el7
  • php-dba-0:5.4.16-42.el7
  • php-debuginfo-0:5.4.16-42.el7
  • php-devel-0:5.4.16-42.el7
  • php-embedded-0:5.4.16-42.el7
  • php-enchant-0:5.4.16-42.el7
  • php-fpm-0:5.4.16-42.el7
  • php-gd-0:5.4.16-42.el7
  • php-intl-0:5.4.16-42.el7
  • php-ldap-0:5.4.16-42.el7
  • php-mbstring-0:5.4.16-42.el7
  • php-mysql-0:5.4.16-42.el7
  • php-mysqlnd-0:5.4.16-42.el7
  • php-odbc-0:5.4.16-42.el7
  • php-pdo-0:5.4.16-42.el7
  • php-pgsql-0:5.4.16-42.el7
  • php-process-0:5.4.16-42.el7
  • php-pspell-0:5.4.16-42.el7
  • php-recode-0:5.4.16-42.el7
  • php-snmp-0:5.4.16-42.el7
  • php-soap-0:5.4.16-42.el7
  • php-xml-0:5.4.16-42.el7
  • php-xmlrpc-0:5.4.16-42.el7
  • rh-php56-0:2.3-1.el6
  • rh-php56-0:2.3-1.el7
  • rh-php56-php-0:5.6.25-1.el6
  • rh-php56-php-0:5.6.25-1.el7
  • rh-php56-php-bcmath-0:5.6.25-1.el6
  • rh-php56-php-bcmath-0:5.6.25-1.el7
  • rh-php56-php-cli-0:5.6.25-1.el6
  • rh-php56-php-cli-0:5.6.25-1.el7
  • rh-php56-php-common-0:5.6.25-1.el6
  • rh-php56-php-common-0:5.6.25-1.el7
  • rh-php56-php-dba-0:5.6.25-1.el6
  • rh-php56-php-dba-0:5.6.25-1.el7
  • rh-php56-php-dbg-0:5.6.25-1.el6
  • rh-php56-php-dbg-0:5.6.25-1.el7
  • rh-php56-php-debuginfo-0:5.6.25-1.el6
  • rh-php56-php-debuginfo-0:5.6.25-1.el7
  • rh-php56-php-devel-0:5.6.25-1.el6
  • rh-php56-php-devel-0:5.6.25-1.el7
  • rh-php56-php-embedded-0:5.6.25-1.el6
  • rh-php56-php-embedded-0:5.6.25-1.el7
  • rh-php56-php-enchant-0:5.6.25-1.el6
  • rh-php56-php-enchant-0:5.6.25-1.el7
  • rh-php56-php-fpm-0:5.6.25-1.el6
  • rh-php56-php-fpm-0:5.6.25-1.el7
  • rh-php56-php-gd-0:5.6.25-1.el6
  • rh-php56-php-gd-0:5.6.25-1.el7
  • rh-php56-php-gmp-0:5.6.25-1.el6
  • rh-php56-php-gmp-0:5.6.25-1.el7
  • rh-php56-php-imap-0:5.6.25-1.el6
  • rh-php56-php-intl-0:5.6.25-1.el6
  • rh-php56-php-intl-0:5.6.25-1.el7
  • rh-php56-php-ldap-0:5.6.25-1.el6
  • rh-php56-php-ldap-0:5.6.25-1.el7
  • rh-php56-php-mbstring-0:5.6.25-1.el6
  • rh-php56-php-mbstring-0:5.6.25-1.el7
  • rh-php56-php-mysqlnd-0:5.6.25-1.el6
  • rh-php56-php-mysqlnd-0:5.6.25-1.el7
  • rh-php56-php-odbc-0:5.6.25-1.el6
  • rh-php56-php-odbc-0:5.6.25-1.el7
  • rh-php56-php-opcache-0:5.6.25-1.el6
  • rh-php56-php-opcache-0:5.6.25-1.el7
  • rh-php56-php-pdo-0:5.6.25-1.el6
  • rh-php56-php-pdo-0:5.6.25-1.el7
  • rh-php56-php-pear-1:1.9.5-4.el6
  • rh-php56-php-pear-1:1.9.5-4.el7
  • rh-php56-php-pgsql-0:5.6.25-1.el6
  • rh-php56-php-pgsql-0:5.6.25-1.el7
  • rh-php56-php-process-0:5.6.25-1.el6
  • rh-php56-php-process-0:5.6.25-1.el7
  • rh-php56-php-pspell-0:5.6.25-1.el6
  • rh-php56-php-pspell-0:5.6.25-1.el7
  • rh-php56-php-recode-0:5.6.25-1.el6
  • rh-php56-php-recode-0:5.6.25-1.el7
  • rh-php56-php-snmp-0:5.6.25-1.el6
  • rh-php56-php-snmp-0:5.6.25-1.el7
  • rh-php56-php-soap-0:5.6.25-1.el6
  • rh-php56-php-soap-0:5.6.25-1.el7
  • rh-php56-php-tidy-0:5.6.25-1.el6
  • rh-php56-php-xml-0:5.6.25-1.el6
  • rh-php56-php-xml-0:5.6.25-1.el7
  • rh-php56-php-xmlrpc-0:5.6.25-1.el6
  • rh-php56-php-xmlrpc-0:5.6.25-1.el7
  • rh-php56-runtime-0:2.3-1.el6
  • rh-php56-runtime-0:2.3-1.el7
  • rh-php56-scldevel-0:2.3-1.el6
  • rh-php56-scldevel-0:2.3-1.el7
refmap via4
bid 91395
confirm
mlist [oss-security] 20160623 Re: CVE for PHP 5.5.37 issues
suse
  • SUSE-SU-2016:2013
  • openSUSE-SU-2016:1761
  • openSUSE-SU-2016:1922
Last major update 05-01-2018 - 02:31
Published 07-08-2016 - 10:59
Last modified 05-01-2018 - 02:31
Back to Top