CVE-2016-3074

Published: Apr 26, 2016Modified: May 6, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Integer signedness error in GD Graphics Library 2.1.1 (aka libgd or libgd2) allows remote attackers to cause a denial of service (crash) or potentially execute arbitrary code via crafted compressed gd2 data, which triggers a heap-based buffer overflow.

Affected (13)

Products: Libgd: Libgd · Debian: Debian Linux · Fedoraproject: Fedora · +3 more

Show all products

Libgd: Libgd · Debian: Debian Linux · Fedoraproject: Fedora · Canonical: Ubuntu Linux · Opensuse: Opensuse · Php: Php

1 product

1 product

1 product

1 product

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Libgd Libgd	Version 2.1.1

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 7.0
Debian Debian Linux	Version 8.0

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 23
Fedoraproject Fedora	Version 24

Configuration D

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 15.10
Canonical Ubuntu Linux	Version 16.04

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 13.2

Configuration F

3 vulnerable

Vulnerable Software	Affected Versions
Php Php	From 5.5.0 to 5.5.35
Php Php	From 5.6.0 to 5.6.21
Php Php	From 7.0.0 to 7.0.6

Related CWEs

CWE-681

Incorrect Conversion between Numeric Types

When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.

References (36)

http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183263.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183724.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00031.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://packetstormsecurity.com/files/136757/libgd-2.1.1-Signedness.html

Source: secalert@redhat.com

ExploitThird Party AdvisoryVDB Entry

http://rhn.redhat.com/errata/RHSA-2016-2750.html

Source: secalert@redhat.com

Third Party Advisory

http://seclists.org/fulldisclosure/2016/Apr/72

Source: secalert@redhat.com

ExploitMailing ListThird Party Advisory

http://www.debian.org/security/2016/dsa-3556

Source: secalert@redhat.com

Third Party Advisory

http://www.debian.org/security/2016/dsa-3602

Source: secalert@redhat.com

Third Party Advisory

http://www.securityfocus.com/archive/1/538160/100/0/threaded

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/87087

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1035659

Source: secalert@redhat.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.383127

Source: secalert@redhat.com

Third Party Advisory

http://www.ubuntu.com/usn/USN-2987-1

Source: secalert@redhat.com

Third Party Advisory

https://github.com/libgd/libgd/commit/2bb97f407c1145c850416a3bfbcc8cf124e68a19

Source: secalert@redhat.com

PatchThird Party Advisory

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731

Source: secalert@redhat.com

Third Party Advisory

https://security.gentoo.org/glsa/201607-04

Source: secalert@redhat.com

Third Party Advisory

https://security.gentoo.org/glsa/201611-22

Source: secalert@redhat.com

Third Party Advisory

https://www.exploit-db.com/exploits/39736/

Source: secalert@redhat.com

ExploitThird Party AdvisoryVDB Entry

http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183263.html