CVE-2016-6912 Double free vulnerability in the gdImageWebPtr function in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via large width and height values.
CriticalCVSS 9.8
EPSS 4.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Double free vulnerability in the gdImageWebPtr function in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via large width and height values.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libgd2(Debian:12) | < 2.2.4-1 | 2.2.4-1 |
| debian/libgd2(Debian:13) | < 2.2.4-1 | 2.2.4-1 |
| debian/libgd2(Debian:14) | < 2.2.4-1 | 2.2.4-1 |
| libgd | <= 2.2.3 | No fix listed |
| alpine/gd(Alpine:v3.3) | < 2.2.4-r0 | 2.2.4-r0 |
| alpine/gd(Alpine:v3.4) | < 2.2.4-r0 | 2.2.4-r0 |
| alpine/gd(Alpine:v3.5) | < 2.2.4-r0 | 2.2.4-r0 |
References
- Debian Security Tracker CVE-2016-6912 vendor-advisory
- DSA-3777 vendor-advisory
- 95843 vdb-entry
- github.com patch release-notes
- github.com patch vendor-advisory
- security.alpinelinux.org vendor-advisory