PT-2016-3099 · Gd+5 · Gd Graphics Library+5

Onur Taslioglu · Publicado 2016-12-31 · Atualizado 2024-06-15 · CVE-2016-10168

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GD Graphics Library versions prior to 2.2.4

Description The issue is caused by an integer overflow in the gd io.c component of the GD Graphics Library. This can be exploited by a remote attacker to achieve an unspecified impact by manipulating the number of horizontal and vertical elements in an image.

Recommendations For versions prior to 2.2.4, update to version 2.2.4 or later to resolve the issue. As a temporary workaround, consider restricting the processing of images with large numbers of horizontal and vertical chunks to minimize the risk of exploitation.

Correção

DoS

Integer Overflow

Enumeração de Fraquezas

CWE-190

Identificadores relacionados

BDU:2017-00761

CESA-2017_3221

CVE-2016-10168

DLA-804-1

DSA-3777-1

MGASA-2017-0055

MGASA-2017-0086

OPENSUSE-SU-2017_0588-1

OPENSUSE-SU-2024:10777-1

RHSA-2017:3221

RHSA-2017_3221

RHSA-2018:1296

SUSE-SU-2017:0459-1

SUSE-SU-2017:0468-1

SUSE-SU-2017:0534-1

SUSE-SU-2017:0556-1

SUSE-SU-2017:0568-1

SUSE-SU-2017:2522-1

SUSE-SU-2017_2522-1

USN-3213-1

Produtos afetados

Centos

Fortios

Gd Graphics Library

Red Hat

Suse

Ubuntu

Referências · 109

• https://github.com/libgd/libgd/issues/354 · Correção
• https://github.com/libgd/libgd/commit/69d2fd2c597ffc0c217de1238b9bf4d4bceba8e6 · Correção
• https://github.com/libgd/libgd/releases/tag/gd-2.2.4 · Nota
• https://advisories.mageia.org/MGASA-2017-0055.html · Nota de Segurança
• https://ubuntu.com/security/CVE-2016-6912 · Aviso do Fabricante
• https://bugzilla.suse.com/1022265 · Nota
• https://ubuntu.com/security/CVE-2016-10167 · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-3777-1 · Aviso do Fabricante
• https://bugzilla.suse.com/1048096 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-10168 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2024:10777-1 · Aviso do Fabricante
• https://suse.com/support/update/announcement/2017/suse-su-20170534-1 · Nota
• https://suse.com/support/update/announcement/2017/suse-su-20170568-1 · Nota
• https://ubuntu.com/security/CVE-2016-10168 · Aviso do Fabricante
• http://debian.org/security/2017/dsa-3777 · Aviso do Fabricante