CVE-2016-3074 Integer signedness error in GD Graphics Library 2.1.1 (aka libgd or libgd2) allows remote attackers to cause a denial of service (crash) or potentially execute arbitrary code via crafted compressed gd...
CriticalCVSS 9.8
EPSS 35.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Integer signedness error in GD Graphics Library 2.1.1 (aka libgd or libgd2) allows remote attackers to cause a denial of service (crash) or potentially execute arbitrary code via crafted compressed gd2 data, which triggers a heap-based buffer overflow.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libgd2(Debian:12) | < 2.1.1-4.1 | 2.1.1-4.1 |
| debian/libgd2(Debian:13) | < 2.1.1-4.1 | 2.1.1-4.1 |
| debian/libgd2(Debian:14) | < 2.1.1-4.1 | 2.1.1-4.1 |
| libgd | = 2.1.1 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| fedoraproject fedora | = 23 | No fix listed |
| fedoraproject fedora | = 24 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 15.10 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| opensuse | = 13.2 | No fix listed |
| PHP | >= 5.5.0, < 5.5.35 | 5.5.35 |
| PHP | >= 5.6.0, < 5.6.21 | 5.6.21 |
| PHP | >= 7.0.0, < 7.0.6 | 7.0.6 |
| alpine/gd(Alpine:v3.2) | < 2.2.1-r2 | 2.2.1-r2 |
| alpine/gd(Alpine:v3.3) | < 2.2.1-r2 | 2.2.1-r2 |
| alpine/gd(Alpine:v3.4) | < 2.2.1-r0 | 2.2.1-r0 |
References
- PHP 7.0.6 Released vendor-advisory
- Debian Security Tracker CVE-2016-3074 vendor-advisory
- bugs.debian.org issue-tracking
- FEDORA-2016-5f91f43826 mailing-list third-party-advisory vendor-advisory
- FEDORA-2016-0c57b12c7b mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2016:1274 mailing-list third-party-advisory vendor-advisory
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- RHSA-2016:2750 third-party-advisory vendor-advisory
- 20160421 CVE-2016-3074: libgd: signedness vulnerability exploit mailing-list third-party-advisory
- DSA-3556 third-party-advisory vendor-advisory
- DSA-3602 third-party-advisory vendor-advisory
- 20160421 CVE-2016-3074: libgd: signedness vulnerability mailing-list third-party-advisory vdb-entry
- 87087 third-party-advisory vdb-entry
- 1035659 broken-link third-party-advisory vdb-entry
- SSA:2016-120-02 third-party-advisory vendor-advisory
- USN-2987-1 third-party-advisory vendor-advisory
- github.com patch third-party-advisory
- h20566.www2.hpe.com third-party-advisory
- GLSA-201607-04 third-party-advisory vendor-advisory
- GLSA-201611-22 third-party-advisory vendor-advisory
- 39736 exploit third-party-advisory vdb-entry
- security.alpinelinux.org vendor-advisory