The gdImageCreateFromTgaCtx function in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before
    2.2.3, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to
    cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified
    other impact via crafted chunk dimensions in an image. (CVE-2016-5766)

  - The gdImageCropThreshold function in gd_crop.c in the GD Graphics Library (aka libgd) before 2.2.3, as
    used in PHP before 7.0.9, allows remote attackers to cause a denial of service (application crash) via an
    invalid color index. (CVE-2016-6128)

  - The gdImageCreateFromTgaCtx function in the GD Graphics Library (aka libgd) before 2.2.3 allows remote
    attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file. (CVE-2016-6132)

  - Integer overflow in the _gdContributionsAlloc function in gd_interpolation.c in GD Graphics Library (aka
    libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds memory write or
    memory consumption) via unspecified vectors. (CVE-2016-6207)

  - gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of
    service (out-of-bounds read) via a crafted TGA file. (CVE-2016-6214)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Integer overflow in the gdImageCreate function in gd.c in the GD Graphics Library (aka libgd) before
    2.0.34RC1, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote
    attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have
    unspecified other impact via a crafted image dimensions. (CVE-2016-5767)

  - Stack consumption vulnerability in GD in PHP before 5.6.12 allows remote attackers to cause a denial of
    service via a crafted imagefilltoborder call. (CVE-2015-8874)

  - Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before
    2.2.3, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to
    cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified
    other impact via crafted chunk dimensions in an image. (CVE-2016-5766)

  - The gdImageCropThreshold function in gd_crop.c in the GD Graphics Library (aka libgd) before 2.2.3, as
    used in PHP before 7.0.9, allows remote attackers to cause a denial of service (application crash) via an
    invalid color index. (CVE-2016-6128)

The remote host is affected by the vulnerability described in GLSA-201612-09 (GD: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in GD. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update for gd fixes the following issues :

  - CVE-2016-6214: Buffer over-read issue when parsing     crafted TGA file [bsc#991436]

  - CVE-2016-6132: read out-of-bands was found in the     parsing of TGA files using libgd [bsc#987577]

  - CVE-2016-6128: Invalid color index not properly handled     [bsc#991710]

  - CVE-2016-6207: Integer overflow error within
    _gdContributionsAlloc() [bsc#991622]

  - CVE-2016-6161: global out of bounds read when encoding     gif from malformed input withgd2togif [bsc#988032]

  - CVE-2016-5116: avoid stack overflow (read) with large     names [bsc#982176]

  - CVE-2016-6905: Out-of-bounds read in function     read_image_tga in gd_tga.c [bsc#995034]

This update was imported from the SUSE:SLE-12:Update update project.

This update for gd fixes the following issues :

  - CVE-2016-6214: Buffer over-read issue when parsing     crafted TGA file [bsc#991436]

  - CVE-2016-6132: read out-of-bands was found in the     parsing of TGA files using libgd [bsc#987577]

  - CVE-2016-6128: Invalid color index not properly handled     [bsc#991710]

  - CVE-2016-6207: Integer overflow error within
    _gdContributionsAlloc() [bsc#991622]

  - CVE-2016-6161: global out of bounds read when encoding     gif from malformed input withgd2togif [bsc#988032]

  - CVE-2016-5116: avoid stack overflow (read) with large     names [bsc#982176]

  - CVE-2016-6905: Out-of-bounds read in function     read_image_tga in gd_tga.c [bsc#995034]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for gd fixes the following issues :

  - CVE-2016-6214: Buffer over-read issue when parsing     crafted TGA file [bsc#991436]

  - CVE-2016-6132: read out-of-bands was found in the     parsing of TGA files using libgd [bsc#987577]

  - CVE-2016-6128: Invalid color index not properly handled     [bsc#991710]

  - CVE-2016-6207: Integer overflow error within
    _gdContributionsAlloc() [bsc#991622]

  - CVE-2016-6161: global out of bounds read when encoding     gif from malformed input withgd2togif [bsc#988032]

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3060-1 advisory.

    It was discovered that the GD library incorrectly handled certain malformed TGA images. If a user or     automated system were tricked into processing a specially crafted TGA image, an attacker could cause a     denial of service. (CVE-2016-6132, CVE-2016-6214)

    It was discovered that the GD library incorrectly handled memory when using gdImageScale(). A remote     attacker could possibly use this issue to cause a denial of service or possibly execute arbitrary code.
    (CVE-2016-6207)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Pierre Joye reports :

- fix php bug 72339, Integer Overflow in _gd2GetHeader (CVE-2016-5766)

- gd: Buffer over-read issue when parsing crafted TGA file (CVE-2016-6132)

- Integer overflow error within _gdContributionsAlloc() (CVE-2016-6207)

- fix php bug 72494, invalid color index not handled, can lead to crash ( CVE-2016-6128)

**LibGD 2.2.3 release**

Security related fixes: This flaw is caused by loading data from external sources (file, custom ctx, etc) and are hard to validate before calling libgd APIs :

  - fix php bug php#72339, Integer Overflow in _gd2GetHeader     (CVE-2016-5766)

  - bug #248, fix Out-Of-Bounds Read in read_image_tga

Using application provided parameters, in these cases invalid data causes the issues :

  - Integer overflow error within _gdContributionsAlloc()     (CVE-2016-6207)

  - fix php bug php#72494, invalid color index not handled,     can lead to crash

  - improve color check for CropThreshold

Important update :

  - gdImageCopyResampled has been improved. Better handling     of images with alpha channel, also brings libgd in sync     with php's bundled gd.

This is a recommended update.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in libgd2, a library for programmatic graphics creation and manipulation. A remote attacker can take advantage of these flaws to cause a denial-of-service against an application using the libgd2 library (application crash), or potentially to execute arbitrary code with the privileges of the user running the application.

ID	Name	Product	Family	Severity
404533	Alpine: gd: security update to 2.2.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
404533	Alpine: gd: security update to 2.2.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
400956	Alpine: multiple gd packages, libgd: security update to 2.2.1-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
400956	Alpine: multiple gd packages, libgd: security update to 2.2.1-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
95524	GLSA-201612-09 : GD: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
93701	openSUSE Security Update : gd (openSUSE-2016-1108)	Nessus	SuSE Local Security Checks	critical
93506	SUSE SLED12 / SLES12 Security Update : gd (SUSE-SU-2016:2303-1)	Nessus	SuSE Local Security Checks	critical
93063	openSUSE Security Update : gd (openSUSE-2016-1003)	Nessus	SuSE Local Security Checks	high
92869	Ubuntu 14.04 LTS / 16.04 LTS : GD library vulnerabilities (USN-3060-1)	Nessus	Ubuntu Local Security Checks	medium
92740	FreeBSD : gd -- multiple vulnerabilities (556d2286-5a51-11e6-a6c3-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	high
92532	Fedora 24 : gd (2016-615f3bf06e)	Nessus	Fedora Local Security Checks	high
92327	Debian DSA-3619-1 : libgd2 - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2016-6132

medium

Tenable Plugins

high

high

high

high

critical

critical

critical

high

medium

high

high

critical