PT-2016-7160 · Libgd+1 · Gd Graphics Library+1

Ke Liu · Published 2016-07-15 · Updated 2024-06-15 · CVE-2016-6905

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GD Graphics Library (aka libgd) versions prior to 2.2.3

Description The issue allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA image. This is due to a problem in the read image tga function in gd tga.c.

Recommendations For versions prior to 2.2.3, update to version 2.2.3 or later to resolve the issue. As a temporary workaround, consider restricting the processing of TGA images until a patch is applied.

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2016-6905

DSA-3619-1

OPENSUSE-SU-2024:10062-1

SUSE-SU-2016:2303-1

USN-3060-1

Affected Products

Gd Graphics Library

Suse

References · 55

• https://github.com/libgd/libgd/issues/248 · Patch
• https://github.com/libgd/libgd/commit/01c61f8ab110a77ae64b5ca67c244c728c506f03 · Patch
• https://github.com/libgd/libgd/pull/251 · Patch
• https://github.com/libgd/libgd/commit/3c2b605d72e8b080dace1d98a6e50b46c1d12186 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2024:10062-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-6905 · Security Note
• https://security-tracker.debian.org/tracker/DSA-3619-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/libgd2 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-6905 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6207 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6128 · Security Note
• https://ubuntu.com/security/CVE-2016-6132 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3619-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-6905 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-6905 · Security Note