CVE-2016-5766

Published: Aug 7, 2016Modified: May 6, 2026

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via crafted chunk dimensions in an image.

Affected (22)

Products: Redhat: Openshift, Enterprise Linux · Freebsd: Freebsd · Libgd: Libgd · +2 more

Show all products

Redhat: Openshift, Enterprise Linux · Freebsd: Freebsd · Libgd: Libgd · Fedoraproject: Fedora · Debian: Debian Linux

2 products

Enterprise Linux

1 product

1 product

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Openshift	Version 2.0

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Freebsd Freebsd	Version 8.3

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 6.0

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Freebsd Freebsd	Version 8.0

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 5

Configuration F

1 vulnerable · 40 platform

Vulnerable Software	Affected Versions
Libgd Libgd	Version 2.2.2

Running on/with	Platform Versions
Php Php	Up to 5.5.36
Php Php	Version 5.6.0 alpha1
Php Php	Version 5.6.0 alpha2
Php Php	Version 5.6.0 alpha3
Php Php	Version 5.6.0 alpha4
Php Php	Version 5.6.0 alpha5
Php Php	Version 5.6.0 beta1
Php Php	Version 5.6.0 beta2
Php Php	Version 5.6.0 beta3
Php Php	Version 5.6.0 beta4
Php Php	Version 5.6.10
Php Php	Version 5.6.11
Php Php	Version 5.6.12
Php Php	Version 5.6.13
Php Php	Version 5.6.14
Php Php	Version 5.6.15
Php Php	Version 5.6.16
Php Php	Version 5.6.17
Php Php	Version 5.6.18
Php Php	Version 5.6.19
Php Php	Version 5.6.1
Php Php	Version 5.6.20
Php Php	Version 5.6.21
Php Php	Version 5.6.22
Php Php	Version 5.6.2
Php Php	Version 5.6.3
Php Php	Version 5.6.4
Php Php	Version 5.6.5
Php Php	Version 5.6.6
Php Php	Version 5.6.7
Php Php	Version 5.6.8
Php Php	Version 5.6.9
Php Php	Version 7.0.0
Php Php	Version 7.0.1
Php Php	Version 7.0.2
Php Php	Version 7.0.3
Php Php	Version 7.0.4
Php Php	Version 7.0.5
Php Php	Version 7.0.6
Php Php	Version 7.0.7

Configuration G

1 vulnerable

Vulnerable Software	Affected Versions
Freebsd Freebsd	Version 10.0

Configuration H

1 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 23

Configuration I

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0

Configuration J

1 vulnerable

Vulnerable Software	Affected Versions
Freebsd Freebsd	Version 10.1

Configuration K

1 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 24

Configuration L

1 vulnerable

Vulnerable Software	Affected Versions
Freebsd Freebsd	Version 8.4

Configuration M

1 vulnerable

Vulnerable Software	Affected Versions
Freebsd Freebsd	Version 9.2

Configuration N

1 vulnerable

Vulnerable Software	Affected Versions
Freebsd Freebsd	Version 8.2

Configuration O

1 vulnerable

Vulnerable Software	Affected Versions
Freebsd Freebsd	Version 8.1

Configuration P

1 vulnerable

Vulnerable Software	Affected Versions
Freebsd Freebsd	Version 9.0

Configuration Q

1 vulnerable

Vulnerable Software	Affected Versions
Freebsd Freebsd	Version 10.2

Configuration R

1 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 22

Configuration S

1 vulnerable

Vulnerable Software	Affected Versions
Freebsd Freebsd	Version 9.3

Configuration T

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 7.0

Configuration U

1 vulnerable

Vulnerable Software	Affected Versions
Freebsd Freebsd	Version 10.3

Configuration V

1 vulnerable

Vulnerable Software	Affected Versions
Freebsd Freebsd	Version 9.1

Related CWEs

Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

References (30)

http://github.com/php/php-src/commit/7722455726bec8c53458a32851d2a87982cf0eac?w=1

Source: cve@mitre.org

ExploitPatch

http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00004.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00025.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-updates/2016-08/msg00003.html

Source: cve@mitre.org

http://php.net/ChangeLog-5.php

Source: cve@mitre.org

Release Notes

http://php.net/ChangeLog-7.php

Source: cve@mitre.org

Release Notes

http://rhn.redhat.com/errata/RHSA-2016-2598.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2016-2750.html

Source: cve@mitre.org

http://www.debian.org/security/2016/dsa-3619

Source: cve@mitre.org

Third Party Advisory

http://www.openwall.com/lists/oss-security/2016/06/23/4

Source: cve@mitre.org

Release Notes

http://www.ubuntu.com/usn/USN-3030-1

Source: cve@mitre.org

https://bugs.php.net/bug.php?id=72339

Source: cve@mitre.org

ExploitPatchVendor Advisory

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731

Source: cve@mitre.org

https://libgd.github.io/release-2.2.3.html

Source: cve@mitre.org

Release Notes

https://security.gentoo.org/glsa/201612-09

Source: cve@mitre.org

http://github.com/php/php-src/commit/7722455726bec8c53458a32851d2a87982cf0eac?w=1

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00004.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00025.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-updates/2016-08/msg00003.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://php.net/ChangeLog-5.php

Source: af854a3a-2127-422b-91ae-364da2661108

Release Notes

http://php.net/ChangeLog-7.php

Source: af854a3a-2127-422b-91ae-364da2661108

Release Notes

http://rhn.redhat.com/errata/RHSA-2016-2598.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2016-2750.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2016/dsa-3619

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.openwall.com/lists/oss-security/2016/06/23/4

Source: af854a3a-2127-422b-91ae-364da2661108

Release Notes

http://www.ubuntu.com/usn/USN-3030-1

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugs.php.net/bug.php?id=72339

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatchVendor Advisory

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731

Source: af854a3a-2127-422b-91ae-364da2661108

https://libgd.github.io/release-2.2.3.html

Source: af854a3a-2127-422b-91ae-364da2661108

Release Notes

https://security.gentoo.org/glsa/201612-09

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.