Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2016-5116 (GCVE-0-2016-5116)
Vulnerability from cvelistv5
Published
2016-08-07 10:00
Modified
2024-08-06 00:53
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T00:53:47.352Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "openSUSE-SU-2016:2363",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-09/msg00078.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/libgd/libgd/issues/211"
},
{
"name": "[oss-security] 20160529 Re: CVE Request: libgd - gdCtxPrintf memory leak",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2016/05/29/5"
},
{
"name": "DSA-3619",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3619"
},
{
"name": "USN-3030-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-3030-1"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/libgd/libgd/commit/4dc1a2d7931017d3625f2d7cff70a17ce58b53b4"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-05-29T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-11-25T20:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "openSUSE-SU-2016:2363",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-09/msg00078.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/libgd/libgd/issues/211"
},
{
"name": "[oss-security] 20160529 Re: CVE Request: libgd - gdCtxPrintf memory leak",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2016/05/29/5"
},
{
"name": "DSA-3619",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3619"
},
{
"name": "USN-3030-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-3030-1"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/libgd/libgd/commit/4dc1a2d7931017d3625f2d7cff70a17ce58b53b4"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-5116",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "openSUSE-SU-2016:2363",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-09/msg00078.html"
},
{
"name": "https://github.com/libgd/libgd/issues/211",
"refsource": "CONFIRM",
"url": "https://github.com/libgd/libgd/issues/211"
},
{
"name": "[oss-security] 20160529 Re: CVE Request: libgd - gdCtxPrintf memory leak",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2016/05/29/5"
},
{
"name": "DSA-3619",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3619"
},
{
"name": "USN-3030-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-3030-1"
},
{
"name": "https://github.com/libgd/libgd/commit/4dc1a2d7931017d3625f2d7cff70a17ce58b53b4",
"refsource": "CONFIRM",
"url": "https://github.com/libgd/libgd/commit/4dc1a2d7931017d3625f2d7cff70a17ce58b53b4"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-5116",
"datePublished": "2016-08-07T10:00:00",
"dateReserved": "2016-05-29T00:00:00",
"dateUpdated": "2024-08-06T00:53:47.352Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2016-5116\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2016-08-07T10:59:12.257\",\"lastModified\":\"2025-04-12T10:46:40.837\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name.\"},{\"lang\":\"es\",\"value\":\"gd_xbm.c en la GD Graphics Library (tambi\u00e9n conocido como libgd) en versiones anteriores a 2.2.0, como se utiliza en ciertas configuraciones personalizadas PHP 5.5.x, permite a atacantes dependientes del contexto obtener informaci\u00f3n sensible del proceso de memoria o provocar una denegaci\u00f3n de servicio (lectura debajo de desbordamiento de b\u00fafer basado en la pila y ca\u00edda de aplicaci\u00f3n) a trav\u00e9s de un nombre largo.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:N/A:P\",\"baseScore\":6.4,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":4.9,\"acInsufInfo\":true,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-119\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:libgd:libgd:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2.2.1\",\"matchCriteriaId\":\"73B08A9F-CFCC-4B42-8F53-FC8C8AA44501\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9F6D9B19-E64D-4BED-9194-17460CE19E6F\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.0:alpha1:*:*:*:*:*:*\",\"matchCriteriaId\":\"3D25E591-448C-4E3B-8557-6E48F7571796\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.0:alpha2:*:*:*:*:*:*\",\"matchCriteriaId\":\"6DA18F3F-B4B5-40C3-BF19-67C1F0C1787D\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.0:alpha3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3AF783C9-26E7-4E02-BD41-77B9783667E3\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.0:alpha4:*:*:*:*:*:*\",\"matchCriteriaId\":\"EF49701D-ECE4-4CEB-BDAB-24C09C8AD4B4\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.0:alpha5:*:*:*:*:*:*\",\"matchCriteriaId\":\"7AEDF6F7-001D-4A35-A26F-417991AD377F\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.0:alpha6:*:*:*:*:*:*\",\"matchCriteriaId\":\"4031DB99-B4B4-41EC-B3C1-543D92C575A9\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.0:beta1:*:*:*:*:*:*\",\"matchCriteriaId\":\"D5450EA7-A398-49D2-AA8E-7C95B074BAB1\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.0:beta2:*:*:*:*:*:*\",\"matchCriteriaId\":\"04FE0E4E-BC94-4DC9-BE9B-DC57B952B2FB\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.0:beta3:*:*:*:*:*:*\",\"matchCriteriaId\":\"BB8E09D8-9CBE-4279-88B7-24A214A5A537\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.0:beta4:*:*:*:*:*:*\",\"matchCriteriaId\":\"2D41ECCE-887D-49A2-9BB3-B559495AC55B\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"79B418BC-27F4-4443-A0F7-FF4ADA568C1B\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"8EEBDF62-BA1B-4438-9AEA-8B56AA5713E8\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F644EA6C-50C6-4A1C-A4AC-287AA9477B46\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DD47F30-74F5-48E8-8657-C2373FE2BD22\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0C09527B-6B47-41F8-BDE6-01C47E452286\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2E454D87-23CB-4D7F-90FE-942EE54D661F\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1031E646-F2CF-4A3E-8E6A-5D4BC950BEDA\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"130E50C1-D209-4CFF-9399-69D561340FBB\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C1F29948-9417-460B-8B04-D91AE4E8B423\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A37D00C1-4F41-4400-9CE4-8E8BAA3E4142\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"093D08B7-CC3C-4616-8697-F15B253A7D9A\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E9CD8FEE-DE7B-47CB-9985-4092BFA071D0\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A30B2D9E-F289-43C9-BFBC-1CEF284A417E\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FE41CFDF-8ECD-41C1-94A7-5AFD42C5DDEA\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6AEAC9BA-AF82-4345-839C-D339DCB962A7\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1EFE682F-52E3-48EC-A993-F522FC29712F\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.18:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AC63A449-5D92-4F5F-8186-B58FFFBA54FE\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.19:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F18236F6-2065-4A6A-93E7-FD90E650C689\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.20:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DEFBA84A-A4E4-438B-B9B5-8549809DCECC\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.21:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"146D3DC9-50F4-430B-B321-68ECE78879A7\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.22:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D5A7CA6-7653-46C5-8DF7-95584BF7A879\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.23:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C5BA8300-2F4D-4C1E-8CCE-F45E8F3547A0\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.24:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"59A42F02-F363-4C13-BE83-19F757B84455\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.25:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"423ECD5F-5611-4D9A-8BE8-E4DC1527AF58\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.26:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"44FE4648-22C5-44A6-A6DF-8B235EB7DEF5\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.27:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"23006CC4-85FB-48AF-8F3A-97BC3FD7FAF6\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.28:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D6393D02-3968-4B0F-A2DE-61442E95DB32\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.29:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0F0E1ABF-05E0-4FB9-841E-6287B9D7E4D3\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.30:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0CDB4ADD-2148-47CD-93B2-1DD65067659A\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.31:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7FE4651D-40F4-44BF-88AD-D0BFB85399D3\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.32:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9AE68A1B-B1EE-40BD-A294-69FE44746420\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.33:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D4F004EF-2D0C-4ED3-A2D7-5BCB6B32C718\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.34:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"65F170BE-283F-4C66-A123-562F8C93C097\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.35:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CD1E1C27-7D14-414D-B067-48DD48B671A7\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.37:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C4FF1053-A485-47F3-B60E-F5A68AE46A5D\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4863BE36-D16A-4D75-90D9-FD76DB5B48B7\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-updates/2016-09/msg00078.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.debian.org/security/2016/dsa-3619\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2016/05/29/5\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\"]},{\"url\":\"http://www.ubuntu.com/usn/USN-3030-1\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://github.com/libgd/libgd/commit/4dc1a2d7931017d3625f2d7cff70a17ce58b53b4\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/libgd/libgd/issues/211\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-updates/2016-09/msg00078.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.debian.org/security/2016/dsa-3619\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2016/05/29/5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]},{\"url\":\"http://www.ubuntu.com/usn/USN-3030-1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/libgd/libgd/commit/4dc1a2d7931017d3625f2d7cff70a17ce58b53b4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/libgd/libgd/issues/211\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]}]}}"
}
}
cnvd-2016-03817
Vulnerability from cnvd
Title
libgd内存泄露漏洞
Description
libgd(又名GD Graphics Library或libgd2)是美国软件开发者Thomas Boutell所研发的一个开源的用于动态创建图像的库,它支持创建图表、图形和缩略图等。
libgd的‘gdCtxPrintf’函数中存在内存泄露漏洞,该漏洞源于程序未检查‘vsnprintf’函数的返回值,PHP 5.5版本将输出指定的长度值。攻击者可利用该漏洞造成内存数据泄露。
Severity
中
VLAI Severity ?
Patch Name
libgd内存泄露漏洞的补丁
Patch Description
libgd(又名GD Graphics Library或libgd2)是美国软件开发者Thomas Boutell所研发的一个开源的用于动态创建图像的库,它支持创建图表、图形和缩略图等。
libgd的‘gdCtxPrintf’函数中存在内存泄露漏洞,该漏洞源于程序未检查‘vsnprintf’函数的返回值,PHP 5.5版本将输出指定的长度值。攻击者可利用该漏洞造成内存数据泄露。目前,供应商发布了安全公告及相关补丁信息,修复了此漏洞。
Formal description
目前厂商已经发布了升级补丁以修复此安全问题,补丁获取链接: https://github.com/libgd/libgd/issues/211
Reference
http://www.openwall.com/lists/oss-security/2016/05/29/5
Impacted products
| Name | Libgd Libgd |
|---|
{
"cves": {
"cve": {
"cveNumber": "CVE-2016-5116"
}
},
"description": "libgd\uff08\u53c8\u540dGD Graphics Library\u6216libgd2\uff09\u662f\u7f8e\u56fd\u8f6f\u4ef6\u5f00\u53d1\u8005Thomas Boutell\u6240\u7814\u53d1\u7684\u4e00\u4e2a\u5f00\u6e90\u7684\u7528\u4e8e\u52a8\u6001\u521b\u5efa\u56fe\u50cf\u7684\u5e93\uff0c\u5b83\u652f\u6301\u521b\u5efa\u56fe\u8868\u3001\u56fe\u5f62\u548c\u7f29\u7565\u56fe\u7b49\u3002\r\n\r\nlibgd\u7684\u2018gdCtxPrintf\u2019\u51fd\u6570\u4e2d\u5b58\u5728\u5185\u5b58\u6cc4\u9732\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u68c0\u67e5\u2018vsnprintf\u2019\u51fd\u6570\u7684\u8fd4\u56de\u503c\uff0cPHP 5.5\u7248\u672c\u5c06\u8f93\u51fa\u6307\u5b9a\u7684\u957f\u5ea6\u503c\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u5185\u5b58\u6570\u636e\u6cc4\u9732\u3002",
"discovererName": "unknown",
"formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://github.com/libgd/libgd/issues/211",
"isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
"number": "CNVD-2016-03817",
"openTime": "2016-06-07",
"patchDescription": "libgd\uff08\u53c8\u540dGD Graphics Library\u6216libgd2\uff09\u662f\u7f8e\u56fd\u8f6f\u4ef6\u5f00\u53d1\u8005Thomas Boutell\u6240\u7814\u53d1\u7684\u4e00\u4e2a\u5f00\u6e90\u7684\u7528\u4e8e\u52a8\u6001\u521b\u5efa\u56fe\u50cf\u7684\u5e93\uff0c\u5b83\u652f\u6301\u521b\u5efa\u56fe\u8868\u3001\u56fe\u5f62\u548c\u7f29\u7565\u56fe\u7b49\u3002\r\n\r\nlibgd\u7684\u2018gdCtxPrintf\u2019\u51fd\u6570\u4e2d\u5b58\u5728\u5185\u5b58\u6cc4\u9732\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u68c0\u67e5\u2018vsnprintf\u2019\u51fd\u6570\u7684\u8fd4\u56de\u503c\uff0cPHP 5.5\u7248\u672c\u5c06\u8f93\u51fa\u6307\u5b9a\u7684\u957f\u5ea6\u503c\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u5185\u5b58\u6570\u636e\u6cc4\u9732\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
"patchName": "libgd\u5185\u5b58\u6cc4\u9732\u6f0f\u6d1e\u7684\u8865\u4e01",
"products": {
"product": "Libgd Libgd"
},
"referenceLink": "http://www.openwall.com/lists/oss-security/2016/05/29/5",
"serverity": "\u4e2d",
"submitTime": "2016-06-03",
"title": "libgd\u5185\u5b58\u6cc4\u9732\u6f0f\u6d1e"
}
fkie_cve-2016-5116
Vulnerability from fkie_nvd
Published
2016-08-07 10:59
Modified
2025-04-12 10:46
Severity ?
Summary
gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name.
References
| URL | Tags | ||
|---|---|---|---|
| cve@mitre.org | http://lists.opensuse.org/opensuse-updates/2016-09/msg00078.html | Third Party Advisory | |
| cve@mitre.org | http://www.debian.org/security/2016/dsa-3619 | Third Party Advisory | |
| cve@mitre.org | http://www.openwall.com/lists/oss-security/2016/05/29/5 | Mailing List | |
| cve@mitre.org | http://www.ubuntu.com/usn/USN-3030-1 | ||
| cve@mitre.org | https://github.com/libgd/libgd/commit/4dc1a2d7931017d3625f2d7cff70a17ce58b53b4 | Issue Tracking, Patch, Third Party Advisory | |
| cve@mitre.org | https://github.com/libgd/libgd/issues/211 | Issue Tracking, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-updates/2016-09/msg00078.html | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2016/dsa-3619 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.openwall.com/lists/oss-security/2016/05/29/5 | Mailing List | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.ubuntu.com/usn/USN-3030-1 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/libgd/libgd/commit/4dc1a2d7931017d3625f2d7cff70a17ce58b53b4 | Issue Tracking, Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/libgd/libgd/issues/211 | Issue Tracking, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| libgd | libgd | * | |
| php | php | 5.5.0 | |
| php | php | 5.5.0 | |
| php | php | 5.5.0 | |
| php | php | 5.5.0 | |
| php | php | 5.5.0 | |
| php | php | 5.5.0 | |
| php | php | 5.5.0 | |
| php | php | 5.5.0 | |
| php | php | 5.5.0 | |
| php | php | 5.5.0 | |
| php | php | 5.5.0 | |
| php | php | 5.5.0 | |
| php | php | 5.5.0 | |
| php | php | 5.5.1 | |
| php | php | 5.5.2 | |
| php | php | 5.5.3 | |
| php | php | 5.5.4 | |
| php | php | 5.5.5 | |
| php | php | 5.5.6 | |
| php | php | 5.5.7 | |
| php | php | 5.5.8 | |
| php | php | 5.5.9 | |
| php | php | 5.5.10 | |
| php | php | 5.5.11 | |
| php | php | 5.5.12 | |
| php | php | 5.5.13 | |
| php | php | 5.5.14 | |
| php | php | 5.5.18 | |
| php | php | 5.5.19 | |
| php | php | 5.5.20 | |
| php | php | 5.5.21 | |
| php | php | 5.5.22 | |
| php | php | 5.5.23 | |
| php | php | 5.5.24 | |
| php | php | 5.5.25 | |
| php | php | 5.5.26 | |
| php | php | 5.5.27 | |
| php | php | 5.5.28 | |
| php | php | 5.5.29 | |
| php | php | 5.5.30 | |
| php | php | 5.5.31 | |
| php | php | 5.5.32 | |
| php | php | 5.5.33 | |
| php | php | 5.5.34 | |
| php | php | 5.5.35 | |
| php | php | 5.5.37 | |
| opensuse | leap | 42.1 | |
| debian | debian_linux | 8.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:libgd:libgd:*:*:*:*:*:*:*:*",
"matchCriteriaId": "73B08A9F-CFCC-4B42-8F53-FC8C8AA44501",
"versionEndIncluding": "2.2.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:php:php:5.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9F6D9B19-E64D-4BED-9194-17460CE19E6F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.0:alpha1:*:*:*:*:*:*",
"matchCriteriaId": "3D25E591-448C-4E3B-8557-6E48F7571796",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.0:alpha2:*:*:*:*:*:*",
"matchCriteriaId": "6DA18F3F-B4B5-40C3-BF19-67C1F0C1787D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.0:alpha3:*:*:*:*:*:*",
"matchCriteriaId": "3AF783C9-26E7-4E02-BD41-77B9783667E3",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.0:alpha4:*:*:*:*:*:*",
"matchCriteriaId": "EF49701D-ECE4-4CEB-BDAB-24C09C8AD4B4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.0:alpha5:*:*:*:*:*:*",
"matchCriteriaId": "7AEDF6F7-001D-4A35-A26F-417991AD377F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.0:alpha6:*:*:*:*:*:*",
"matchCriteriaId": "4031DB99-B4B4-41EC-B3C1-543D92C575A9",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "D5450EA7-A398-49D2-AA8E-7C95B074BAB1",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.0:beta2:*:*:*:*:*:*",
"matchCriteriaId": "04FE0E4E-BC94-4DC9-BE9B-DC57B952B2FB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.0:beta3:*:*:*:*:*:*",
"matchCriteriaId": "BB8E09D8-9CBE-4279-88B7-24A214A5A537",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.0:beta4:*:*:*:*:*:*",
"matchCriteriaId": "2D41ECCE-887D-49A2-9BB3-B559495AC55B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "79B418BC-27F4-4443-A0F7-FF4ADA568C1B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "8EEBDF62-BA1B-4438-9AEA-8B56AA5713E8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F644EA6C-50C6-4A1C-A4AC-287AA9477B46",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "4DD47F30-74F5-48E8-8657-C2373FE2BD22",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "0C09527B-6B47-41F8-BDE6-01C47E452286",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "2E454D87-23CB-4D7F-90FE-942EE54D661F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1031E646-F2CF-4A3E-8E6A-5D4BC950BEDA",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.6:*:*:*:*:*:*:*",
"matchCriteriaId": "130E50C1-D209-4CFF-9399-69D561340FBB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.7:*:*:*:*:*:*:*",
"matchCriteriaId": "C1F29948-9417-460B-8B04-D91AE4E8B423",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.8:*:*:*:*:*:*:*",
"matchCriteriaId": "A37D00C1-4F41-4400-9CE4-8E8BAA3E4142",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.9:*:*:*:*:*:*:*",
"matchCriteriaId": "093D08B7-CC3C-4616-8697-F15B253A7D9A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.10:*:*:*:*:*:*:*",
"matchCriteriaId": "E9CD8FEE-DE7B-47CB-9985-4092BFA071D0",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.11:*:*:*:*:*:*:*",
"matchCriteriaId": "A30B2D9E-F289-43C9-BFBC-1CEF284A417E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.12:*:*:*:*:*:*:*",
"matchCriteriaId": "FE41CFDF-8ECD-41C1-94A7-5AFD42C5DDEA",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.13:*:*:*:*:*:*:*",
"matchCriteriaId": "6AEAC9BA-AF82-4345-839C-D339DCB962A7",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.14:*:*:*:*:*:*:*",
"matchCriteriaId": "1EFE682F-52E3-48EC-A993-F522FC29712F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.18:*:*:*:*:*:*:*",
"matchCriteriaId": "AC63A449-5D92-4F5F-8186-B58FFFBA54FE",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.19:*:*:*:*:*:*:*",
"matchCriteriaId": "F18236F6-2065-4A6A-93E7-FD90E650C689",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.20:*:*:*:*:*:*:*",
"matchCriteriaId": "DEFBA84A-A4E4-438B-B9B5-8549809DCECC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.21:*:*:*:*:*:*:*",
"matchCriteriaId": "146D3DC9-50F4-430B-B321-68ECE78879A7",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.22:*:*:*:*:*:*:*",
"matchCriteriaId": "1D5A7CA6-7653-46C5-8DF7-95584BF7A879",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.23:*:*:*:*:*:*:*",
"matchCriteriaId": "C5BA8300-2F4D-4C1E-8CCE-F45E8F3547A0",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.24:*:*:*:*:*:*:*",
"matchCriteriaId": "59A42F02-F363-4C13-BE83-19F757B84455",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.25:*:*:*:*:*:*:*",
"matchCriteriaId": "423ECD5F-5611-4D9A-8BE8-E4DC1527AF58",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.26:*:*:*:*:*:*:*",
"matchCriteriaId": "44FE4648-22C5-44A6-A6DF-8B235EB7DEF5",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.27:*:*:*:*:*:*:*",
"matchCriteriaId": "23006CC4-85FB-48AF-8F3A-97BC3FD7FAF6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.28:*:*:*:*:*:*:*",
"matchCriteriaId": "D6393D02-3968-4B0F-A2DE-61442E95DB32",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.29:*:*:*:*:*:*:*",
"matchCriteriaId": "0F0E1ABF-05E0-4FB9-841E-6287B9D7E4D3",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.30:*:*:*:*:*:*:*",
"matchCriteriaId": "0CDB4ADD-2148-47CD-93B2-1DD65067659A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.31:*:*:*:*:*:*:*",
"matchCriteriaId": "7FE4651D-40F4-44BF-88AD-D0BFB85399D3",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.32:*:*:*:*:*:*:*",
"matchCriteriaId": "9AE68A1B-B1EE-40BD-A294-69FE44746420",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.33:*:*:*:*:*:*:*",
"matchCriteriaId": "D4F004EF-2D0C-4ED3-A2D7-5BCB6B32C718",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.34:*:*:*:*:*:*:*",
"matchCriteriaId": "65F170BE-283F-4C66-A123-562F8C93C097",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.35:*:*:*:*:*:*:*",
"matchCriteriaId": "CD1E1C27-7D14-414D-B067-48DD48B671A7",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:php:php:5.5.37:*:*:*:*:*:*:*",
"matchCriteriaId": "C4FF1053-A485-47F3-B60E-F5A68AE46A5D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4863BE36-D16A-4D75-90D9-FD76DB5B48B7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name."
},
{
"lang": "es",
"value": "gd_xbm.c en la GD Graphics Library (tambi\u00e9n conocido como libgd) en versiones anteriores a 2.2.0, como se utiliza en ciertas configuraciones personalizadas PHP 5.5.x, permite a atacantes dependientes del contexto obtener informaci\u00f3n sensible del proceso de memoria o provocar una denegaci\u00f3n de servicio (lectura debajo de desbordamiento de b\u00fafer basado en la pila y ca\u00edda de aplicaci\u00f3n) a trav\u00e9s de un nombre largo."
}
],
"id": "CVE-2016-5116",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": true,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.2,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-08-07T10:59:12.257",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-09/msg00078.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2016/dsa-3619"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List"
],
"url": "http://www.openwall.com/lists/oss-security/2016/05/29/5"
},
{
"source": "cve@mitre.org",
"url": "http://www.ubuntu.com/usn/USN-3030-1"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/libgd/libgd/commit/4dc1a2d7931017d3625f2d7cff70a17ce58b53b4"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://github.com/libgd/libgd/issues/211"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-09/msg00078.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2016/dsa-3619"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List"
],
"url": "http://www.openwall.com/lists/oss-security/2016/05/29/5"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.ubuntu.com/usn/USN-3030-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/libgd/libgd/commit/4dc1a2d7931017d3625f2d7cff70a17ce58b53b4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://github.com/libgd/libgd/issues/211"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
ghsa-mvgw-h4r7-8g56
Vulnerability from github
Published
2022-05-14 02:12
Modified
2022-05-14 02:12
Severity ?
VLAI Severity ?
Details
gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name.
{
"affected": [],
"aliases": [
"CVE-2016-5116"
],
"database_specific": {
"cwe_ids": [
"CWE-119"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-08-07T10:59:00Z",
"severity": "CRITICAL"
},
"details": "gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name.",
"id": "GHSA-mvgw-h4r7-8g56",
"modified": "2022-05-14T02:12:14Z",
"published": "2022-05-14T02:12:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-5116"
},
{
"type": "WEB",
"url": "https://github.com/libgd/libgd/issues/211"
},
{
"type": "WEB",
"url": "https://github.com/libgd/libgd/commit/4dc1a2d7931017d3625f2d7cff70a17ce58b53b4"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2016-09/msg00078.html"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2016/dsa-3619"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/05/29/5"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-3030-1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
suse-su-2016:2303-1
Vulnerability from csaf_suse
Published
2016-09-14 07:12
Modified
2016-09-14 07:12
Summary
Security update for gd
Notes
Title of the patch
Security update for gd
Description of the patch
This update for gd fixes the following issues:
* CVE-2016-6214: Buffer over-read issue when parsing crafted TGA file [bsc#991436]
* CVE-2016-6132: read out-of-bands was found in the parsing of TGA files using libgd [bsc#987577]
* CVE-2016-6128: Invalid color index not properly handled [bsc#991710]
* CVE-2016-6207: Integer overflow error within _gdContributionsAlloc() [bsc#991622]
* CVE-2016-6161: global out of bounds read when encoding gif from malformed input withgd2togif [bsc#988032]
* CVE-2016-5116: avoid stack overflow (read) with large names [bsc#982176]
* CVE-2016-6905: Out-of-bounds read in function read_image_tga in gd_tga.c [bsc#995034]
Patchnames
SUSE-SLE-DESKTOP-12-SP1-2016-1347,SUSE-SLE-SDK-12-SP1-2016-1347,SUSE-SLE-SERVER-12-SP1-2016-1347,SUSE-SLE-WE-12-SP1-2016-1347
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for gd",
"title": "Title of the patch"
},
{
"category": "description",
"text": "\nThis update for gd fixes the following issues:\n\n * CVE-2016-6214: Buffer over-read issue when parsing crafted TGA file [bsc#991436]\n * CVE-2016-6132: read out-of-bands was found in the parsing of TGA files using libgd [bsc#987577]\n * CVE-2016-6128: Invalid color index not properly handled [bsc#991710]\n * CVE-2016-6207: Integer overflow error within _gdContributionsAlloc() [bsc#991622]\n * CVE-2016-6161: global out of bounds read when encoding gif from malformed input withgd2togif [bsc#988032]\n * CVE-2016-5116: avoid stack overflow (read) with large names [bsc#982176]\n * CVE-2016-6905: Out-of-bounds read in function read_image_tga in gd_tga.c [bsc#995034]\n\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLE-DESKTOP-12-SP1-2016-1347,SUSE-SLE-SDK-12-SP1-2016-1347,SUSE-SLE-SERVER-12-SP1-2016-1347,SUSE-SLE-WE-12-SP1-2016-1347",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2016_2303-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2016:2303-1",
"url": "https://www.suse.com/support/update/announcement/2016/suse-su-20162303-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2016:2303-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2016-September/002271.html"
},
{
"category": "self",
"summary": "SUSE Bug 982176",
"url": "https://bugzilla.suse.com/982176"
},
{
"category": "self",
"summary": "SUSE Bug 987577",
"url": "https://bugzilla.suse.com/987577"
},
{
"category": "self",
"summary": "SUSE Bug 988032",
"url": "https://bugzilla.suse.com/988032"
},
{
"category": "self",
"summary": "SUSE Bug 991436",
"url": "https://bugzilla.suse.com/991436"
},
{
"category": "self",
"summary": "SUSE Bug 991622",
"url": "https://bugzilla.suse.com/991622"
},
{
"category": "self",
"summary": "SUSE Bug 991710",
"url": "https://bugzilla.suse.com/991710"
},
{
"category": "self",
"summary": "SUSE Bug 995034",
"url": "https://bugzilla.suse.com/995034"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-5116 page",
"url": "https://www.suse.com/security/cve/CVE-2016-5116/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-6128 page",
"url": "https://www.suse.com/security/cve/CVE-2016-6128/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-6132 page",
"url": "https://www.suse.com/security/cve/CVE-2016-6132/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-6161 page",
"url": "https://www.suse.com/security/cve/CVE-2016-6161/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-6207 page",
"url": "https://www.suse.com/security/cve/CVE-2016-6207/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-6214 page",
"url": "https://www.suse.com/security/cve/CVE-2016-6214/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-6905 page",
"url": "https://www.suse.com/security/cve/CVE-2016-6905/"
}
],
"title": "Security update for gd",
"tracking": {
"current_release_date": "2016-09-14T07:12:19Z",
"generator": {
"date": "2016-09-14T07:12:19Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2016:2303-1",
"initial_release_date": "2016-09-14T07:12:19Z",
"revision_history": [
{
"date": "2016-09-14T07:12:19Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "gd-devel-2.1.0-12.1.ppc64le",
"product": {
"name": "gd-devel-2.1.0-12.1.ppc64le",
"product_id": "gd-devel-2.1.0-12.1.ppc64le"
}
},
{
"category": "product_version",
"name": "gd-2.1.0-12.1.ppc64le",
"product": {
"name": "gd-2.1.0-12.1.ppc64le",
"product_id": "gd-2.1.0-12.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "gd-devel-2.1.0-12.1.s390x",
"product": {
"name": "gd-devel-2.1.0-12.1.s390x",
"product_id": "gd-devel-2.1.0-12.1.s390x"
}
},
{
"category": "product_version",
"name": "gd-2.1.0-12.1.s390x",
"product": {
"name": "gd-2.1.0-12.1.s390x",
"product_id": "gd-2.1.0-12.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "gd-2.1.0-12.1.x86_64",
"product": {
"name": "gd-2.1.0-12.1.x86_64",
"product_id": "gd-2.1.0-12.1.x86_64"
}
},
{
"category": "product_version",
"name": "gd-32bit-2.1.0-12.1.x86_64",
"product": {
"name": "gd-32bit-2.1.0-12.1.x86_64",
"product_id": "gd-32bit-2.1.0-12.1.x86_64"
}
},
{
"category": "product_version",
"name": "gd-devel-2.1.0-12.1.x86_64",
"product": {
"name": "gd-devel-2.1.0-12.1.x86_64",
"product_id": "gd-devel-2.1.0-12.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Desktop 12 SP1",
"product": {
"name": "SUSE Linux Enterprise Desktop 12 SP1",
"product_id": "SUSE Linux Enterprise Desktop 12 SP1",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sled:12:sp1"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Software Development Kit 12 SP1",
"product": {
"name": "SUSE Linux Enterprise Software Development Kit 12 SP1",
"product_id": "SUSE Linux Enterprise Software Development Kit 12 SP1",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-sdk:12:sp1"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 12 SP1",
"product": {
"name": "SUSE Linux Enterprise Server 12 SP1",
"product_id": "SUSE Linux Enterprise Server 12 SP1",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:12:sp1"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:12:sp1"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Workstation Extension 12 SP1",
"product": {
"name": "SUSE Linux Enterprise Workstation Extension 12 SP1",
"product_id": "SUSE Linux Enterprise Workstation Extension 12 SP1",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-we:12:sp1"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "gd-2.1.0-12.1.x86_64 as component of SUSE Linux Enterprise Desktop 12 SP1",
"product_id": "SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64"
},
"product_reference": "gd-2.1.0-12.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Desktop 12 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gd-32bit-2.1.0-12.1.x86_64 as component of SUSE Linux Enterprise Desktop 12 SP1",
"product_id": "SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64"
},
"product_reference": "gd-32bit-2.1.0-12.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Desktop 12 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gd-devel-2.1.0-12.1.ppc64le as component of SUSE Linux Enterprise Software Development Kit 12 SP1",
"product_id": "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le"
},
"product_reference": "gd-devel-2.1.0-12.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gd-devel-2.1.0-12.1.s390x as component of SUSE Linux Enterprise Software Development Kit 12 SP1",
"product_id": "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x"
},
"product_reference": "gd-devel-2.1.0-12.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gd-devel-2.1.0-12.1.x86_64 as component of SUSE Linux Enterprise Software Development Kit 12 SP1",
"product_id": "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64"
},
"product_reference": "gd-devel-2.1.0-12.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gd-2.1.0-12.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP1",
"product_id": "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le"
},
"product_reference": "gd-2.1.0-12.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gd-2.1.0-12.1.s390x as component of SUSE Linux Enterprise Server 12 SP1",
"product_id": "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x"
},
"product_reference": "gd-2.1.0-12.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gd-2.1.0-12.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP1",
"product_id": "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64"
},
"product_reference": "gd-2.1.0-12.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gd-2.1.0-12.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le"
},
"product_reference": "gd-2.1.0-12.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gd-2.1.0-12.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x"
},
"product_reference": "gd-2.1.0-12.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gd-2.1.0-12.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64"
},
"product_reference": "gd-2.1.0-12.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gd-32bit-2.1.0-12.1.x86_64 as component of SUSE Linux Enterprise Workstation Extension 12 SP1",
"product_id": "SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64"
},
"product_reference": "gd-32bit-2.1.0-12.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Workstation Extension 12 SP1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-5116",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-5116"
}
],
"notes": [
{
"category": "general",
"text": "gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-5116",
"url": "https://www.suse.com/security/cve/CVE-2016-5116"
},
{
"category": "external",
"summary": "SUSE Bug 982176 for CVE-2016-5116",
"url": "https://bugzilla.suse.com/982176"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-09-14T07:12:19Z",
"details": "moderate"
}
],
"title": "CVE-2016-5116"
},
{
"cve": "CVE-2016-6128",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-6128"
}
],
"notes": [
{
"category": "general",
"text": "The gdImageCropThreshold function in gd_crop.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 7.0.9, allows remote attackers to cause a denial of service (application crash) via an invalid color index.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-6128",
"url": "https://www.suse.com/security/cve/CVE-2016-6128"
},
{
"category": "external",
"summary": "SUSE Bug 987580 for CVE-2016-6128",
"url": "https://bugzilla.suse.com/987580"
},
{
"category": "external",
"summary": "SUSE Bug 991710 for CVE-2016-6128",
"url": "https://bugzilla.suse.com/991710"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-09-14T07:12:19Z",
"details": "moderate"
}
],
"title": "CVE-2016-6128"
},
{
"cve": "CVE-2016-6132",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-6132"
}
],
"notes": [
{
"category": "general",
"text": "The gdImageCreateFromTgaCtx function in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-6132",
"url": "https://www.suse.com/security/cve/CVE-2016-6132"
},
{
"category": "external",
"summary": "SUSE Bug 987577 for CVE-2016-6132",
"url": "https://bugzilla.suse.com/987577"
},
{
"category": "external",
"summary": "SUSE Bug 991436 for CVE-2016-6132",
"url": "https://bugzilla.suse.com/991436"
},
{
"category": "external",
"summary": "SUSE Bug 995034 for CVE-2016-6132",
"url": "https://bugzilla.suse.com/995034"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-09-14T07:12:19Z",
"details": "moderate"
}
],
"title": "CVE-2016-6132"
},
{
"cve": "CVE-2016-6161",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-6161"
}
],
"notes": [
{
"category": "general",
"text": "The output function in gd_gif_out.c in the GD Graphics Library (aka libgd) allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted image.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-6161",
"url": "https://www.suse.com/security/cve/CVE-2016-6161"
},
{
"category": "external",
"summary": "SUSE Bug 988032 for CVE-2016-6161",
"url": "https://bugzilla.suse.com/988032"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-09-14T07:12:19Z",
"details": "low"
}
],
"title": "CVE-2016-6161"
},
{
"cve": "CVE-2016-6207",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-6207"
}
],
"notes": [
{
"category": "general",
"text": "Integer overflow in the _gdContributionsAlloc function in gd_interpolation.c in GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds memory write or memory consumption) via unspecified vectors.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-6207",
"url": "https://www.suse.com/security/cve/CVE-2016-6207"
},
{
"category": "external",
"summary": "SUSE Bug 991434 for CVE-2016-6207",
"url": "https://bugzilla.suse.com/991434"
},
{
"category": "external",
"summary": "SUSE Bug 991622 for CVE-2016-6207",
"url": "https://bugzilla.suse.com/991622"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-09-14T07:12:19Z",
"details": "moderate"
}
],
"title": "CVE-2016-6207"
},
{
"cve": "CVE-2016-6214",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-6214"
}
],
"notes": [
{
"category": "general",
"text": "gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-6214",
"url": "https://www.suse.com/security/cve/CVE-2016-6214"
},
{
"category": "external",
"summary": "SUSE Bug 987577 for CVE-2016-6214",
"url": "https://bugzilla.suse.com/987577"
},
{
"category": "external",
"summary": "SUSE Bug 991436 for CVE-2016-6214",
"url": "https://bugzilla.suse.com/991436"
},
{
"category": "external",
"summary": "SUSE Bug 995034 for CVE-2016-6214",
"url": "https://bugzilla.suse.com/995034"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-09-14T07:12:19Z",
"details": "moderate"
}
],
"title": "CVE-2016-6214"
},
{
"cve": "CVE-2016-6905",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-6905"
}
],
"notes": [
{
"category": "general",
"text": "The read_image_tga function in gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA image.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-6905",
"url": "https://www.suse.com/security/cve/CVE-2016-6905"
},
{
"category": "external",
"summary": "SUSE Bug 995034 for CVE-2016-6905",
"url": "https://bugzilla.suse.com/995034"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x",
"SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64",
"SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-09-14T07:12:19Z",
"details": "moderate"
}
],
"title": "CVE-2016-6905"
}
]
}
opensuse-su-2024:10062-1
Vulnerability from csaf_opensuse
Published
2024-06-15 00:00
Modified
2024-06-15 00:00
Summary
gd-2.2.3-2.1 on GA media
Notes
Title of the patch
gd-2.2.3-2.1 on GA media
Description of the patch
These are all security issues fixed in the gd-2.2.3-2.1 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2024-10062
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "gd-2.2.3-2.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the gd-2.2.3-2.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2024-10062",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_10062-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-2497 page",
"url": "https://www.suse.com/security/cve/CVE-2014-2497/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-5116 page",
"url": "https://www.suse.com/security/cve/CVE-2016-5116/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-5766 page",
"url": "https://www.suse.com/security/cve/CVE-2016-5766/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-6128 page",
"url": "https://www.suse.com/security/cve/CVE-2016-6128/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-6132 page",
"url": "https://www.suse.com/security/cve/CVE-2016-6132/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-6207 page",
"url": "https://www.suse.com/security/cve/CVE-2016-6207/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-6214 page",
"url": "https://www.suse.com/security/cve/CVE-2016-6214/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-6905 page",
"url": "https://www.suse.com/security/cve/CVE-2016-6905/"
}
],
"title": "gd-2.2.3-2.1 on GA media",
"tracking": {
"current_release_date": "2024-06-15T00:00:00Z",
"generator": {
"date": "2024-06-15T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2024:10062-1",
"initial_release_date": "2024-06-15T00:00:00Z",
"revision_history": [
{
"date": "2024-06-15T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "gd-2.2.3-2.1.aarch64",
"product": {
"name": "gd-2.2.3-2.1.aarch64",
"product_id": "gd-2.2.3-2.1.aarch64"
}
},
{
"category": "product_version",
"name": "gd-devel-2.2.3-2.1.aarch64",
"product": {
"name": "gd-devel-2.2.3-2.1.aarch64",
"product_id": "gd-devel-2.2.3-2.1.aarch64"
}
},
{
"category": "product_version",
"name": "libgd3-2.2.3-2.1.aarch64",
"product": {
"name": "libgd3-2.2.3-2.1.aarch64",
"product_id": "libgd3-2.2.3-2.1.aarch64"
}
},
{
"category": "product_version",
"name": "libgd3-32bit-2.2.3-2.1.aarch64",
"product": {
"name": "libgd3-32bit-2.2.3-2.1.aarch64",
"product_id": "libgd3-32bit-2.2.3-2.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "gd-2.2.3-2.1.ppc64le",
"product": {
"name": "gd-2.2.3-2.1.ppc64le",
"product_id": "gd-2.2.3-2.1.ppc64le"
}
},
{
"category": "product_version",
"name": "gd-devel-2.2.3-2.1.ppc64le",
"product": {
"name": "gd-devel-2.2.3-2.1.ppc64le",
"product_id": "gd-devel-2.2.3-2.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libgd3-2.2.3-2.1.ppc64le",
"product": {
"name": "libgd3-2.2.3-2.1.ppc64le",
"product_id": "libgd3-2.2.3-2.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libgd3-32bit-2.2.3-2.1.ppc64le",
"product": {
"name": "libgd3-32bit-2.2.3-2.1.ppc64le",
"product_id": "libgd3-32bit-2.2.3-2.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "gd-2.2.3-2.1.s390x",
"product": {
"name": "gd-2.2.3-2.1.s390x",
"product_id": "gd-2.2.3-2.1.s390x"
}
},
{
"category": "product_version",
"name": "gd-devel-2.2.3-2.1.s390x",
"product": {
"name": "gd-devel-2.2.3-2.1.s390x",
"product_id": "gd-devel-2.2.3-2.1.s390x"
}
},
{
"category": "product_version",
"name": "libgd3-2.2.3-2.1.s390x",
"product": {
"name": "libgd3-2.2.3-2.1.s390x",
"product_id": "libgd3-2.2.3-2.1.s390x"
}
},
{
"category": "product_version",
"name": "libgd3-32bit-2.2.3-2.1.s390x",
"product": {
"name": "libgd3-32bit-2.2.3-2.1.s390x",
"product_id": "libgd3-32bit-2.2.3-2.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "gd-2.2.3-2.1.x86_64",
"product": {
"name": "gd-2.2.3-2.1.x86_64",
"product_id": "gd-2.2.3-2.1.x86_64"
}
},
{
"category": "product_version",
"name": "gd-devel-2.2.3-2.1.x86_64",
"product": {
"name": "gd-devel-2.2.3-2.1.x86_64",
"product_id": "gd-devel-2.2.3-2.1.x86_64"
}
},
{
"category": "product_version",
"name": "libgd3-2.2.3-2.1.x86_64",
"product": {
"name": "libgd3-2.2.3-2.1.x86_64",
"product_id": "libgd3-2.2.3-2.1.x86_64"
}
},
{
"category": "product_version",
"name": "libgd3-32bit-2.2.3-2.1.x86_64",
"product": {
"name": "libgd3-32bit-2.2.3-2.1.x86_64",
"product_id": "libgd3-32bit-2.2.3-2.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "gd-2.2.3-2.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64"
},
"product_reference": "gd-2.2.3-2.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gd-2.2.3-2.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le"
},
"product_reference": "gd-2.2.3-2.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gd-2.2.3-2.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:gd-2.2.3-2.1.s390x"
},
"product_reference": "gd-2.2.3-2.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gd-2.2.3-2.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64"
},
"product_reference": "gd-2.2.3-2.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gd-devel-2.2.3-2.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64"
},
"product_reference": "gd-devel-2.2.3-2.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gd-devel-2.2.3-2.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le"
},
"product_reference": "gd-devel-2.2.3-2.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gd-devel-2.2.3-2.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x"
},
"product_reference": "gd-devel-2.2.3-2.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gd-devel-2.2.3-2.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64"
},
"product_reference": "gd-devel-2.2.3-2.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libgd3-2.2.3-2.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64"
},
"product_reference": "libgd3-2.2.3-2.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libgd3-2.2.3-2.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le"
},
"product_reference": "libgd3-2.2.3-2.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libgd3-2.2.3-2.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x"
},
"product_reference": "libgd3-2.2.3-2.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libgd3-2.2.3-2.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64"
},
"product_reference": "libgd3-2.2.3-2.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libgd3-32bit-2.2.3-2.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64"
},
"product_reference": "libgd3-32bit-2.2.3-2.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libgd3-32bit-2.2.3-2.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le"
},
"product_reference": "libgd3-32bit-2.2.3-2.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libgd3-32bit-2.2.3-2.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x"
},
"product_reference": "libgd3-32bit-2.2.3-2.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libgd3-32bit-2.2.3-2.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64"
},
"product_reference": "libgd3-32bit-2.2.3-2.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2014-2497",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-2497"
}
],
"notes": [
{
"category": "general",
"text": "The gdImageCreateFromXpm function in gdxpm.c in libgd, as used in PHP 5.4.26 and earlier, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted color table in an XPM file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-2497",
"url": "https://www.suse.com/security/cve/CVE-2014-2497"
},
{
"category": "external",
"summary": "SUSE Bug 868624 for CVE-2014-2497",
"url": "https://bugzilla.suse.com/868624"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2014-2497"
},
{
"cve": "CVE-2016-5116",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-5116"
}
],
"notes": [
{
"category": "general",
"text": "gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-5116",
"url": "https://www.suse.com/security/cve/CVE-2016-5116"
},
{
"category": "external",
"summary": "SUSE Bug 982176 for CVE-2016-5116",
"url": "https://bugzilla.suse.com/982176"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2016-5116"
},
{
"cve": "CVE-2016-5766",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-5766"
}
],
"notes": [
{
"category": "general",
"text": "Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via crafted chunk dimensions in an image.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-5766",
"url": "https://www.suse.com/security/cve/CVE-2016-5766"
},
{
"category": "external",
"summary": "SUSE Bug 986386 for CVE-2016-5766",
"url": "https://bugzilla.suse.com/986386"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2016-5766"
},
{
"cve": "CVE-2016-6128",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-6128"
}
],
"notes": [
{
"category": "general",
"text": "The gdImageCropThreshold function in gd_crop.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 7.0.9, allows remote attackers to cause a denial of service (application crash) via an invalid color index.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-6128",
"url": "https://www.suse.com/security/cve/CVE-2016-6128"
},
{
"category": "external",
"summary": "SUSE Bug 987580 for CVE-2016-6128",
"url": "https://bugzilla.suse.com/987580"
},
{
"category": "external",
"summary": "SUSE Bug 991710 for CVE-2016-6128",
"url": "https://bugzilla.suse.com/991710"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2016-6128"
},
{
"cve": "CVE-2016-6132",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-6132"
}
],
"notes": [
{
"category": "general",
"text": "The gdImageCreateFromTgaCtx function in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-6132",
"url": "https://www.suse.com/security/cve/CVE-2016-6132"
},
{
"category": "external",
"summary": "SUSE Bug 987577 for CVE-2016-6132",
"url": "https://bugzilla.suse.com/987577"
},
{
"category": "external",
"summary": "SUSE Bug 991436 for CVE-2016-6132",
"url": "https://bugzilla.suse.com/991436"
},
{
"category": "external",
"summary": "SUSE Bug 995034 for CVE-2016-6132",
"url": "https://bugzilla.suse.com/995034"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2016-6132"
},
{
"cve": "CVE-2016-6207",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-6207"
}
],
"notes": [
{
"category": "general",
"text": "Integer overflow in the _gdContributionsAlloc function in gd_interpolation.c in GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds memory write or memory consumption) via unspecified vectors.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-6207",
"url": "https://www.suse.com/security/cve/CVE-2016-6207"
},
{
"category": "external",
"summary": "SUSE Bug 991434 for CVE-2016-6207",
"url": "https://bugzilla.suse.com/991434"
},
{
"category": "external",
"summary": "SUSE Bug 991622 for CVE-2016-6207",
"url": "https://bugzilla.suse.com/991622"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2016-6207"
},
{
"cve": "CVE-2016-6214",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-6214"
}
],
"notes": [
{
"category": "general",
"text": "gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-6214",
"url": "https://www.suse.com/security/cve/CVE-2016-6214"
},
{
"category": "external",
"summary": "SUSE Bug 987577 for CVE-2016-6214",
"url": "https://bugzilla.suse.com/987577"
},
{
"category": "external",
"summary": "SUSE Bug 991436 for CVE-2016-6214",
"url": "https://bugzilla.suse.com/991436"
},
{
"category": "external",
"summary": "SUSE Bug 995034 for CVE-2016-6214",
"url": "https://bugzilla.suse.com/995034"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2016-6214"
},
{
"cve": "CVE-2016-6905",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-6905"
}
],
"notes": [
{
"category": "general",
"text": "The read_image_tga function in gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA image.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-6905",
"url": "https://www.suse.com/security/cve/CVE-2016-6905"
},
{
"category": "external",
"summary": "SUSE Bug 995034 for CVE-2016-6905",
"url": "https://bugzilla.suse.com/995034"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x",
"openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2016-6905"
}
]
}
gsd-2016-5116
Vulnerability from gsd
Modified
2023-12-13 01:21
Details
gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2016-5116",
"description": "gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name.",
"id": "GSD-2016-5116",
"references": [
"https://www.suse.com/security/cve/CVE-2016-5116.html",
"https://www.debian.org/security/2016/dsa-3619",
"https://ubuntu.com/security/CVE-2016-5116",
"https://advisories.mageia.org/CVE-2016-5116.html"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2016-5116"
],
"details": "gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name.",
"id": "GSD-2016-5116",
"modified": "2023-12-13T01:21:25.347079Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-5116",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "openSUSE-SU-2016:2363",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-09/msg00078.html"
},
{
"name": "https://github.com/libgd/libgd/issues/211",
"refsource": "CONFIRM",
"url": "https://github.com/libgd/libgd/issues/211"
},
{
"name": "[oss-security] 20160529 Re: CVE Request: libgd - gdCtxPrintf memory leak",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2016/05/29/5"
},
{
"name": "DSA-3619",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3619"
},
{
"name": "USN-3030-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-3030-1"
},
{
"name": "https://github.com/libgd/libgd/commit/4dc1a2d7931017d3625f2d7cff70a17ce58b53b4",
"refsource": "CONFIRM",
"url": "https://github.com/libgd/libgd/commit/4dc1a2d7931017d3625f2d7cff70a17ce58b53b4"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:libgd:libgd:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "2.2.1",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.0:beta1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.0:beta2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.11:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.12:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.21:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.22:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.30:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.0:alpha4:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.0:alpha5:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.0:alpha6:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.20:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.27:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.28:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.29:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.35:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.37:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.0:alpha1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.0:beta3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.0:beta4:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.13:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.14:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.23:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.24:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.31:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.32:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.0:alpha2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.0:alpha3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.0:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.0:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.18:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.19:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.25:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.26:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.33:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.34:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:a:php:php:5.5.9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-5116"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/libgd/libgd/commit/4dc1a2d7931017d3625f2d7cff70a17ce58b53b4",
"refsource": "CONFIRM",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/libgd/libgd/commit/4dc1a2d7931017d3625f2d7cff70a17ce58b53b4"
},
{
"name": "[oss-security] 20160529 Re: CVE Request: libgd - gdCtxPrintf memory leak",
"refsource": "MLIST",
"tags": [
"Mailing List"
],
"url": "http://www.openwall.com/lists/oss-security/2016/05/29/5"
},
{
"name": "https://github.com/libgd/libgd/issues/211",
"refsource": "CONFIRM",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://github.com/libgd/libgd/issues/211"
},
{
"name": "DSA-3619",
"refsource": "DEBIAN",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2016/dsa-3619"
},
{
"name": "openSUSE-SU-2016:2363",
"refsource": "SUSE",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-09/msg00078.html"
},
{
"name": "USN-3030-1",
"refsource": "UBUNTU",
"tags": [],
"url": "http://www.ubuntu.com/usn/USN-3030-1"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": true,
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.2
}
},
"lastModifiedDate": "2018-10-30T16:27Z",
"publishedDate": "2016-08-07T10:59Z"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…