PT-2016-3099 · Gd+5 · Gd Graphics Library+5

Onur Taslioglu · Published 2016-12-31 · Updated 2024-06-15 · CVE-2016-10168

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GD Graphics Library versions prior to 2.2.4

Description The issue is caused by an integer overflow in the gd io.c component of the GD Graphics Library. This can be exploited by a remote attacker to achieve an unspecified impact by manipulating the number of horizontal and vertical elements in an image.

Recommendations For versions prior to 2.2.4, update to version 2.2.4 or later to resolve the issue. As a temporary workaround, consider restricting the processing of images with large numbers of horizontal and vertical chunks to minimize the risk of exploitation.

Fix

DoS

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

BDU:2017-00761

CESA-2017_3221

CVE-2016-10168

DLA-804-1

DSA-3777-1

MGASA-2017-0055

MGASA-2017-0086

OPENSUSE-SU-2017_0588-1

OPENSUSE-SU-2024:10777-1

RHSA-2017:3221

RHSA-2017_3221

RHSA-2018:1296

SUSE-SU-2017:0459-1

SUSE-SU-2017:0468-1

SUSE-SU-2017:0534-1

SUSE-SU-2017:0556-1

SUSE-SU-2017:0568-1

SUSE-SU-2017:2522-1

SUSE-SU-2017_2522-1

USN-3213-1

Affected Products

Centos

Fortios

Gd Graphics Library

Red Hat

Suse

Ubuntu

References · 109

• https://github.com/libgd/libgd/issues/354 · Patch
• https://github.com/libgd/libgd/commit/69d2fd2c597ffc0c217de1238b9bf4d4bceba8e6 · Patch
• https://advisories.mageia.org/MGASA-2017-0055.html · Security Note
• https://ubuntu.com/security/CVE-2016-6912 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-10167 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3777-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-10168 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10777-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-10168 · Vendor Advisory
• http://debian.org/security/2017/dsa-3777 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:0468-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-9317 · Vendor Advisory
• http://libgd.github.io/release-2.2.4.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2017-3221.html · Vendor Advisory
• https://debian.org/security/2017/dsa-3777 · Vendor Advisory