CVE-2016-5767
gd: Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow
Severity Score
8.8
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Integer overflow in the gdImageCreate function in gd.c in the GD Graphics Library (aka libgd) before 2.0.34RC1, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted image dimensions.
Desbordamiento de entero en la función gdImageCreate en gd.c en la GD Graphics Library (también conocido como libgd) en versiones anteriores a 2.0.34RC1, como se utiliza en PHP en versiones anteriores a 5.5.37, 5.6.x en versiones anteriores a 5.6.23 y 7.x en versiones anteriores a 7.0.8 permite a atacantes remotos provocar una denegación de servicio (desbordamiento de búfer basado en memoria dinámica y caída de aplicación) o posiblemente tener otro impacto no especificado a través de dimensiones de imagen manipuladas.
An integer overflow flaw, leading to a heap-based buffer overflow was found in the gdImagePaletteToTrueColor() function of PHP's gd extension. A remote attacker could use this flaw to crash a PHP application or execute arbitrary code with the privileges of the user running that PHP application using gd via a specially crafted image buffer.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2016-06-23 CVE Reserved
- 2016-06-26 CVE Published
- 2024-03-25 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-122: Heap-based Buffer Overflow
- CWE-190: Integer Overflow or Wraparound
CAPEC
References (14)
| URL | Tag | Source |
|---|---|---|
| http://github.com/php/php-src/commit/c395c6e5d7e8df37a21265ff76e48fe75ceb5ae6?w=1 | X_refsource_confirm | |
| http://php.net/ChangeLog-5.php | Release Notes | |
| http://php.net/ChangeLog-7.php | Release Notes | |
| http://www.openwall.com/lists/oss-security/2016/06/23/4 | Mailing List |
|
| http://www.securityfocus.com/bid/91395 | Vdb Entry | |
| https://bugs.php.net/bug.php?id=72446 | X_refsource_confirm | |
| https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731 | X_refsource_confirm |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Libgd Search vendor "Libgd" | Libgd Search vendor "Libgd" for product "Libgd" | <= 2.0.33 Search vendor "Libgd" for product "Libgd" and version " <= 2.0.33" | - |
Affected
| in | Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | <= 5.5.36 Search vendor "Php" for product "Php" and version " <= 5.5.36" | - |
Safe
|
| Libgd Search vendor "Libgd" | Libgd Search vendor "Libgd" for product "Libgd" | <= 2.0.33 Search vendor "Libgd" for product "Libgd" and version " <= 2.0.33" | - |
Affected
| in | Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 5.6.0 Search vendor "Php" for product "Php" and version "5.6.0" | alpha1 |
Safe
|
| Libgd Search vendor "Libgd" | Libgd Search vendor "Libgd" for product "Libgd" | <= 2.0.33 Search vendor "Libgd" for product "Libgd" and version " <= 2.0.33" | - |
Affected
| in | Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 5.6.0 Search vendor "Php" for product "Php" and version "5.6.0" | alpha2 |
Safe
|
| Libgd Search vendor "Libgd" | Libgd Search vendor "Libgd" for product "Libgd" | <= 2.0.33 Search vendor "Libgd" for product "Libgd" and version " <= 2.0.33" | - |
Affected
| in | Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 5.6.0 Search vendor "Php" for product "Php" and version "5.6.0" | alpha3 |
Safe
|
| Libgd Search vendor "Libgd" | Libgd Search vendor "Libgd" for product "Libgd" | <= 2.0.33 Search vendor "Libgd" for product "Libgd" and version " <= 2.0.33" | - |
Affected
| in | Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 5.6.0 Search vendor "Php" for product "Php" and version "5.6.0" | alpha4 |
Safe
|
| Libgd Search vendor "Libgd" | Libgd Search vendor "Libgd" for product "Libgd" | <= 2.0.33 Search vendor "Libgd" for product "Libgd" and version " <= 2.0.33" | - |
Affected
| in | Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 5.6.0 Search vendor "Php" for product "Php" and version "5.6.0" | alpha5 |
Safe
|
| Libgd Search vendor "Libgd" | Libgd Search vendor "Libgd" for product "Libgd" | <= 2.0.33 Search vendor "Libgd" for product "Libgd" and version " <= 2.0.33" | - |
Affected
| in | Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 5.6.0 Search vendor "Php" for product "Php" and version "5.6.0" | beta1 |
Safe
|
| Libgd Search vendor "Libgd" | Libgd Search vendor "Libgd" for product "Libgd" | <= 2.0.33 Search vendor "Libgd" for product "Libgd" and version " <= 2.0.33" | - |
Affected
| in | Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 5.6.0 Search vendor "Php" for product "Php" and version "5.6.0" | beta2 |
Safe
|
| Libgd Search vendor "Libgd" | Libgd Search vendor "Libgd" for product "Libgd" | <= 2.0.33 Search vendor "Libgd" for product "Libgd" and version " <= 2.0.33" | - |
Affected
| in | Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 5.6.0 Search vendor "Php" for product "Php" and version "5.6.0" | beta3 |
Safe
|
| Libgd Search vendor "Libgd" | Libgd Search vendor "Libgd" for product "Libgd" | <= 2.0.33 Search vendor "Libgd" for product "Libgd" and version " <= 2.0.33" | - |
Affected
| in | Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 5.6.0 Search vendor "Php" for product "Php" and version "5.6.0" | beta4 |
Safe
|
| Libgd Search vendor "Libgd" | Libgd Search vendor "Libgd" for product "Libgd" | <= 2.0.33 Search vendor "Libgd" for product "Libgd" and version " <= 2.0.33" | - |
Affected
| in | Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 5.6.1 Search vendor "Php" for product "Php" and version "5.6.1" | - |
Safe
|
| Libgd Search vendor "Libgd" | Libgd Search vendor "Libgd" for product "Libgd" | <= 2.0.33 Search vendor "Libgd" for product "Libgd" and version " <= 2.0.33" | - |
Affected
| in | Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 5.6.2 Search vendor "Php" for product "Php" and version "5.6.2" | - |
Safe
|
| Libgd Search vendor "Libgd" | Libgd Search vendor "Libgd" for product "Libgd" | <= 2.0.33 Search vendor "Libgd" for product "Libgd" and version " <= 2.0.33" | - |
Affected
| in | Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 5.6.3 Search vendor "Php" for product "Php" and version "5.6.3" | - |
Safe
|
| Libgd Search vendor "Libgd" | Libgd Search vendor "Libgd" for product "Libgd" | <= 2.0.33 Search vendor "Libgd" for product "Libgd" and version " <= 2.0.33" | - |
Affected
| in | Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 5.6.4 Search vendor "Php" for product "Php" and version "5.6.4" | - |
Safe
|
| Libgd Search vendor "Libgd" | Libgd Search vendor "Libgd" for product "Libgd" | <= 2.0.33 Search vendor "Libgd" for product "Libgd" and version " <= 2.0.33" | - |
Affected
| in | Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 5.6.5 Search vendor "Php" for product "Php" and version "5.6.5" | - |
Safe
|
| Libgd Search vendor "Libgd" | Libgd Search vendor "Libgd" for product "Libgd" | <= 2.0.33 Search vendor "Libgd" for product "Libgd" and version " <= 2.0.33" | - |
Affected
| in | Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 5.6.6 Search vendor "Php" for product "Php" and version "5.6.6" | - |
Safe
|
| Libgd Search vendor "Libgd" | Libgd Search vendor "Libgd" for product "Libgd" | <= 2.0.33 Search vendor "Libgd" for product "Libgd" and version " <= 2.0.33" | - |
Affected
| in | Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 5.6.7 Search vendor "Php" for product "Php" and version "5.6.7" | - |
Safe
|
| Libgd Search vendor "Libgd" | Libgd Search vendor "Libgd" for product "Libgd" | <= 2.0.33 Search vendor "Libgd" for product "Libgd" and version " <= 2.0.33" | - |
Affected
| in | Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 5.6.8 Search vendor "Php" for product "Php" and version "5.6.8" | - |
Safe
|
| Libgd Search vendor "Libgd" | Libgd Search vendor "Libgd" for product "Libgd" | <= 2.0.33 Search vendor "Libgd" for product "Libgd" and version " <= 2.0.33" | - |
Affected
| in | Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 5.6.9 Search vendor "Php" for product "Php" and version "5.6.9" | - |
Safe
|
| Libgd Search vendor "Libgd" | Libgd Search vendor "Libgd" for product "Libgd" | <= 2.0.33 Search vendor "Libgd" for product "Libgd" and version " <= 2.0.33" | - |
Affected
| in | Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 5.6.10 Search vendor "Php" for product "Php" and version "5.6.10" | - |
Safe
|
| Libgd Search vendor "Libgd" | Libgd Search vendor "Libgd" for product "Libgd" | <= 2.0.33 Search vendor "Libgd" for product "Libgd" and version " <= 2.0.33" | - |
Affected
| in | Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 5.6.11 Search vendor "Php" for product "Php" and version "5.6.11" | - |
Safe
|
| Libgd Search vendor "Libgd" | Libgd Search vendor "Libgd" for product "Libgd" | <= 2.0.33 Search vendor "Libgd" for product "Libgd" and version " <= 2.0.33" | - |
Affected
| in | Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 5.6.12 Search vendor "Php" for product "Php" and version "5.6.12" | - |
Safe
|
| Libgd Search vendor "Libgd" | Libgd Search vendor "Libgd" for product "Libgd" | <= 2.0.33 Search vendor "Libgd" for product "Libgd" and version " <= 2.0.33" | - |
Affected
| in | Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 5.6.13 Search vendor "Php" for product "Php" and version "5.6.13" | - |
Safe
|
| Libgd Search vendor "Libgd" | Libgd Search vendor "Libgd" for product "Libgd" | <= 2.0.33 Search vendor "Libgd" for product "Libgd" and version " <= 2.0.33" | - |
Affected
| in | Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 5.6.14 Search vendor "Php" for product "Php" and version "5.6.14" | - |
Safe
|
| Libgd Search vendor "Libgd" | Libgd Search vendor "Libgd" for product "Libgd" | <= 2.0.33 Search vendor "Libgd" for product "Libgd" and version " <= 2.0.33" | - |
Affected
| in | Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 5.6.15 Search vendor "Php" for product "Php" and version "5.6.15" | - |
Safe
|
| Libgd Search vendor "Libgd" | Libgd Search vendor "Libgd" for product "Libgd" | <= 2.0.33 Search vendor "Libgd" for product "Libgd" and version " <= 2.0.33" | - |
Affected
| in | Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 5.6.16 Search vendor "Php" for product "Php" and version "5.6.16" | - |
Safe
|
| Libgd Search vendor "Libgd" | Libgd Search vendor "Libgd" for product "Libgd" | <= 2.0.33 Search vendor "Libgd" for product "Libgd" and version " <= 2.0.33" | - |
Affected
| in | Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 5.6.17 Search vendor "Php" for product "Php" and version "5.6.17" | - |
Safe
|
| Libgd Search vendor "Libgd" | Libgd Search vendor "Libgd" for product "Libgd" | <= 2.0.33 Search vendor "Libgd" for product "Libgd" and version " <= 2.0.33" | - |
Affected
| in | Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 5.6.18 Search vendor "Php" for product "Php" and version "5.6.18" | - |
Safe
|
| Libgd Search vendor "Libgd" | Libgd Search vendor "Libgd" for product "Libgd" | <= 2.0.33 Search vendor "Libgd" for product "Libgd" and version " <= 2.0.33" | - |
Affected
| in | Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 5.6.19 Search vendor "Php" for product "Php" and version "5.6.19" | - |
Safe
|
| Libgd Search vendor "Libgd" | Libgd Search vendor "Libgd" for product "Libgd" | <= 2.0.33 Search vendor "Libgd" for product "Libgd" and version " <= 2.0.33" | - |
Affected
| in | Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 5.6.20 Search vendor "Php" for product "Php" and version "5.6.20" | - |
Safe
|
| Libgd Search vendor "Libgd" | Libgd Search vendor "Libgd" for product "Libgd" | <= 2.0.33 Search vendor "Libgd" for product "Libgd" and version " <= 2.0.33" | - |
Affected
| in | Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 5.6.21 Search vendor "Php" for product "Php" and version "5.6.21" | - |
Safe
|
| Libgd Search vendor "Libgd" | Libgd Search vendor "Libgd" for product "Libgd" | <= 2.0.33 Search vendor "Libgd" for product "Libgd" and version " <= 2.0.33" | - |
Affected
| in | Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 5.6.22 Search vendor "Php" for product "Php" and version "5.6.22" | - |
Safe
|
| Libgd Search vendor "Libgd" | Libgd Search vendor "Libgd" for product "Libgd" | <= 2.0.33 Search vendor "Libgd" for product "Libgd" and version " <= 2.0.33" | - |
Affected
| in | Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 7.0.0 Search vendor "Php" for product "Php" and version "7.0.0" | - |
Safe
|
| Libgd Search vendor "Libgd" | Libgd Search vendor "Libgd" for product "Libgd" | <= 2.0.33 Search vendor "Libgd" for product "Libgd" and version " <= 2.0.33" | - |
Affected
| in | Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 7.0.1 Search vendor "Php" for product "Php" and version "7.0.1" | - |
Safe
|
| Libgd Search vendor "Libgd" | Libgd Search vendor "Libgd" for product "Libgd" | <= 2.0.33 Search vendor "Libgd" for product "Libgd" and version " <= 2.0.33" | - |
Affected
| in | Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 7.0.2 Search vendor "Php" for product "Php" and version "7.0.2" | - |
Safe
|
| Libgd Search vendor "Libgd" | Libgd Search vendor "Libgd" for product "Libgd" | <= 2.0.33 Search vendor "Libgd" for product "Libgd" and version " <= 2.0.33" | - |
Affected
| in | Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 7.0.3 Search vendor "Php" for product "Php" and version "7.0.3" | - |
Safe
|
| Libgd Search vendor "Libgd" | Libgd Search vendor "Libgd" for product "Libgd" | <= 2.0.33 Search vendor "Libgd" for product "Libgd" and version " <= 2.0.33" | - |
Affected
| in | Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 7.0.4 Search vendor "Php" for product "Php" and version "7.0.4" | - |
Safe
|
| Libgd Search vendor "Libgd" | Libgd Search vendor "Libgd" for product "Libgd" | <= 2.0.33 Search vendor "Libgd" for product "Libgd" and version " <= 2.0.33" | - |
Affected
| in | Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 7.0.5 Search vendor "Php" for product "Php" and version "7.0.5" | - |
Safe
|
| Libgd Search vendor "Libgd" | Libgd Search vendor "Libgd" for product "Libgd" | <= 2.0.33 Search vendor "Libgd" for product "Libgd" and version " <= 2.0.33" | - |
Affected
| in | Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 7.0.6 Search vendor "Php" for product "Php" and version "7.0.6" | - |
Safe
|
| Libgd Search vendor "Libgd" | Libgd Search vendor "Libgd" for product "Libgd" | <= 2.0.33 Search vendor "Libgd" for product "Libgd" and version " <= 2.0.33" | - |
Affected
| in | Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 7.0.7 Search vendor "Php" for product "Php" and version "7.0.7" | - |
Safe
|