PT-2016-7163 · Gd+2 · Gd Graphics Library+2

Ibrahim El-Sayed · Published 2016-10-14 · Updated 2017-11-04 · CVE-2016-6911

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GD Graphics Library versions prior to 2.2.4

Description The issue allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TIFF image. This is related to the dynamicGetbuf function.

Recommendations For versions prior to 2.2.4, update to version 2.2.4 or later to resolve the issue. As a temporary workaround, consider restricting the processing of TIFF images until the update is applied.

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2016-6911

DLA-665-1

DSA-3693-1

MGASA-2016-0421

OPENSUSE-SU-2016_2606-1

OPENSUSE-SU-2016_2772-1

OPENSUSE-SU-2016_2831-1

OPENSUSE-SU-2016_2837-1

SUSE-SU-2016:2668-1

SUSE-SU-2016:2670-1

SUSE-SU-2016:2681-1

SUSE-SU-2016:2683-1

SUSE-SU-2016:2683-2

SUSE-SU-2016:2766-1

SUSE-SU-2016_2668-1

SUSE-SU-2016_2670-1

SUSE-SU-2016_2681-1

SUSE-SU-2016_2683-1

SUSE-SU-2016_2683-2

SUSE-SU-2016_2766-1

USN-3117-1

Affected Products

Gd Graphics Library

Suse

Ubuntu

References · 39

• https://github.com/libgd/libgd/commit/4859d69e07504d4b0a4bdf9bcb4d9e3769ca35ae · Patch
• https://github.com/libgd/libgd/pull/353 · Patch
• https://github.com/libgd/libgd/blob/gd-2.2.4/CHANGELOG.md · Patch
• https://ubuntu.com/security/CVE-2016-7568 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-6911 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:2683-2 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3117-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:2683-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-6911 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:2681-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:2766-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-6911 · Security Note
• https://ubuntu.com/security/notices/USN-3117-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3693-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2016-0421 · Vendor Advisory