CVE-2016-7126
php: select_colors write out-of-bounds
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
The imagetruecolortopalette function in ext/gd/gd.c in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate the number of colors, which allows remote attackers to cause a denial of service (select_colors allocation error and out-of-bounds write) or possibly have unspecified other impact via a large value in the third argument.
La función imagetruecolortopalette en ext/gd/gd.c en PHP en versiones anteriores a 5.6.25 y 7.x en versiones anteriores a 7.0.10 no valida adecuadamente el número de colores, lo que permite a atacantes remotos provocar una denegación de servicio (error de localización de colores de selección y escritura fuera de límites) o tener otro posible impacto no especificado a través de un valor largo en el tercer argumento.
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The rh-php56 packages provide a recent stable release of PHP with PEAR 1.9.5 and enhanced language features including constant expressions, variadic functions, arguments unpacking, and the interactive debuger. The memcache, mongo, and XDebug extensions are also included. The rh-php56 Software Collection has been upgraded to version 5.6.25, which provides a number of bug fixes and enhancements over the previous version. Security Fixes in the rh-php56-php component have been added.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2016-09-02 CVE Reserved
- 2016-09-10 CVE Published
- 2024-08-06 CVE Updated
- 2024-08-06 First Exploit
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-787: Out-of-bounds Write
CAPEC
References (13)
| URL | Tag | Source |
|---|---|---|
| http://openwall.com/lists/oss-security/2016/09/02/9 | Mailing List | |
| http://www.php.net/ChangeLog-5.php | Release Notes | |
| http://www.php.net/ChangeLog-7.php | Release Notes | |
| http://www.securityfocus.com/bid/92755 | Third Party Advisory | |
| http://www.securitytracker.com/id/1036680 | Third Party Advisory | |
| https://www.tenable.com/security/tns-2016-19 | Third Party Advisory |
| URL | Date | SRC |
|---|---|---|
| https://bugs.php.net/bug.php?id=72697 | 2024-08-06 |
| URL | Date | SRC |
|---|---|---|
| https://github.com/php/php-src/commit/28022c9b1fd937436ab67bb3d61f652c108baf96 | 2020-11-16 | |
| https://github.com/php/php-src/commit/b6f13a5ef9d6280cf984826a5de012a32c396cd4?w=1 | 2020-11-16 |
| URL | Date | SRC |
|---|---|---|
| http://rhn.redhat.com/errata/RHSA-2016-2750.html | 2020-11-16 | |
| https://security.gentoo.org/glsa/201611-22 | 2020-11-16 | |
| https://access.redhat.com/security/cve/CVE-2016-7126 | 2016-11-15 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1374699 | 2016-11-15 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 7.0.0 Search vendor "Php" for product "Php" and version "7.0.0" | - |
Affected
| ||||||
| Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 7.0.1 Search vendor "Php" for product "Php" and version "7.0.1" | - |
Affected
| ||||||
| Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 7.0.2 Search vendor "Php" for product "Php" and version "7.0.2" | - |
Affected
| ||||||
| Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 7.0.3 Search vendor "Php" for product "Php" and version "7.0.3" | - |
Affected
| ||||||
| Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 7.0.4 Search vendor "Php" for product "Php" and version "7.0.4" | - |
Affected
| ||||||
| Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 7.0.5 Search vendor "Php" for product "Php" and version "7.0.5" | - |
Affected
| ||||||
| Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 7.0.6 Search vendor "Php" for product "Php" and version "7.0.6" | - |
Affected
| ||||||
| Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 7.0.7 Search vendor "Php" for product "Php" and version "7.0.7" | - |
Affected
| ||||||
| Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 7.0.8 Search vendor "Php" for product "Php" and version "7.0.8" | - |
Affected
| ||||||
| Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 7.0.9 Search vendor "Php" for product "Php" and version "7.0.9" | - |
Affected
| ||||||
| Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | <= 5.6.24 Search vendor "Php" for product "Php" and version " <= 5.6.24" | - |
Affected
| ||||||