CVE-2016-9933 Stack consumption vulnerability in the gdImageFillToBorder function in gd.c in the GD Graphics Library (aka libgd) before 2.2.2, as used in PHP before 5.6.28 and 7.x before 7.0.13, allows remote attac...
HighCVSS 7.5
EPSS 6.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Stack consumption vulnerability in the gdImageFillToBorder function in gd.c in the GD Graphics Library (aka libgd) before 2.2.2, as used in PHP before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (segmentation violation) via a crafted imagefilltoborder call that triggers use of a negative color value.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libgd2(Debian:12) | < 2.2.2-29-g3c2b605-1 | 2.2.2-29-g3c2b605-1 |
| debian/libgd2(Debian:13) | < 2.2.2-29-g3c2b605-1 | 2.2.2-29-g3c2b605-1 |
| debian/libgd2(Debian:14) | < 2.2.2-29-g3c2b605-1 | 2.2.2-29-g3c2b605-1 |
| libgd | = 2.2.1 | No fix listed |
References
- Debian Security Tracker CVE-2016-9933 vendor-advisory
- openSUSE-SU-2016:3228 vendor-advisory
- openSUSE-SU-2016:3239 vendor-advisory
- openSUSE-SU-2017:0006 vendor-advisory
- openSUSE-SU-2017:0061 vendor-advisory
- openSUSE-SU-2017:0081 vendor-advisory
- DSA-3751 vendor-advisory
- [oss-security] 20161212 CVE assignment for PHP 5.6.28, 5.6.29, 7.0.13, 7.0.14 and 7.1.0 mailing-list third-party-advisory
- www.php.net release-notes vendor-advisory
- www.php.net release-notes vendor-advisory
- 94865 vdb-entry
- RHSA-2018:1296 vendor-advisory
- bugs.php.net vendor-advisory
- github.com patch vendor-advisory
- github.com vendor-advisory
- github.com vendor-advisory
- bugs.debian.org issue-tracking