The output function in gd_gif_out.c in the GD Graphics Library (aka libgd) allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted image.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The output function in gd_gif_out.c in the GD Graphics Library (aka libgd) allows remote attackers to     cause a denial of service (out-of-bounds read) via a crafted image. (CVE-2016-6161)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Integer signedness error in GD Graphics Library 2.1.1 (aka libgd or libgd2) allows remote attackers to
    cause a denial of service (crash) or potentially execute arbitrary code via crafted compressed gd2 data,
    which triggers a heap-based buffer overflow. (CVE-2016-3074)

  - Stack consumption vulnerability in GD in PHP before 5.6.12 allows remote attackers to cause a denial of
    service via a crafted imagefilltoborder call. (CVE-2015-8874)

  - gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x
    configurations, allows context-dependent attackers to obtain sensitive information from process memory or
    cause a denial of service (stack-based buffer under-read and application crash) via a long name.
    (CVE-2016-5116)

  - Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before
    2.2.3, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to
    cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified
    other impact via crafted chunk dimensions in an image. (CVE-2016-5766)

According to the versions of the gd package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Integer overflow in gd_io.c in the GD Graphics Library     (aka libgd) before 2.2.4 allows remote attackers to     have unspecified impact via vectors involving the     number of horizontal and vertical chunks in an     image.(CVE-2016-10168)

  - The gdImageCreateFromGd2Ctx function in gd_gd2.c in the     GD Graphics Library (aka libgd) before 2.2.4 allows     remote attackers to cause a denial of service     (application crash) via a crafted image     file.(CVE-2016-10167)

  - The dynamicGetbuf function in the GD Graphics Library     (aka libgd) before 2.2.4 allows remote attackers to     cause a denial of service (out-of-bounds read) via a     crafted TIFF image.(CVE-2016-6911)

  - The output function in gd_gif_out.c in the GD Graphics     Library (aka libgd) allows remote attackers to cause a     denial of service (out-of-bounds read) via a crafted     image.(CVE-2016-6161)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the gd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Integer signedness error in GD Graphics Library 2.1.1     (aka libgd or libgd2) allows remote attackers to cause     a denial of service (crash) or potentially execute     arbitrary code via crafted compressed gd2 data, which     triggers a heap-based buffer overflow.(CVE-2016-3074)

  - The output function in gd_gif_out.c in the GD Graphics     Library (aka libgd) allows remote attackers to cause a     denial of service (out-of-bounds read) via a crafted     image.(CVE-2016-6161)

  - Stack consumption vulnerability in the     gdImageFillToBorder function in gd.c in the GD Graphics     Library (aka libgd) before 2.2.2, as used in PHP before     5.6.28 and 7.x before 7.0.13, allows remote attackers     to cause a denial of service (segmentation violation)     via a crafted imagefilltoborder call that triggers use     of a negative color value.(CVE-2016-9933)

  - Double free vulnerability in the gdImagePngPtr function     in libgd2 before 2.2.5 allows remote attackers to cause     a denial of service via vectors related to a palette     with no colors.(CVE-2017-6362)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the gd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The output function in gd_gif_out.c in the GD Graphics     Library (aka libgd) allows remote attackers to cause a     denial of service (out-of-bounds read) via a crafted     image.(CVE-2016-6161)

  - The dynamicGetbuf function in the GD Graphics Library     (aka libgd) before 2.2.4 allows remote attackers to     cause a denial of service (out-of-bounds read) via a     crafted TIFF image.(CVE-2016-6911)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the gd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Integer overflow in gd_io.c in the GD Graphics Library     (aka libgd) before 2.2.4 allows remote attackers to     have unspecified impact via vectors involving the     number of horizontal and vertical chunks in an     image.(CVE-2016-10168)

  - Double free vulnerability in the gdImagePngPtr function     in libgd2 before 2.2.5 allows remote attackers to cause     a denial of service via vectors related to a palette     with no colors.(CVE-2017-6362)

  - Integer signedness error in GD Graphics Library 2.1.1     (aka libgd or libgd2) allows remote attackers to cause     a denial of service (crash) or potentially execute     arbitrary code via crafted compressed gd2 data, which     triggers a heap-based buffer overflow.(CVE-2016-3074)

  - Stack consumption vulnerability in the     gdImageFillToBorder function in gd.c in the GD Graphics     Library (aka libgd) before 2.2.2, as used in PHP before     5.6.28 and 7.x before 7.0.13, allows remote attackers     to cause a denial of service (segmentation violation)     via a crafted imagefilltoborder call that triggers use     of a negative color value.(CVE-2016-9933)

  - gd_gif_in.c in the GD Graphics Library (aka libgd), as     used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x     before 7.1.13, and 7.2.x before 7.2.1, has an integer     signedness error that leads to an infinite loop via a     crafted GIF file, as demonstrated by a call to the     imagecreatefromgif or imagecreatefromstring PHP     function. This is related to GetCode_ and     gdImageCreateFromGifCtx.(CVE-2018-5711)

  - The gdImageCreateFromGd2Ctx function in gd_gd2.c in the     GD Graphics Library (aka libgd) before 2.2.4 allows     remote attackers to cause a denial of service     (application crash) via a crafted image     file.(CVE-2016-10167)

  - The output function in gd_gif_out.c in the GD Graphics     Library (aka libgd) allows remote attackers to cause a     denial of service (out-of-bounds read) via a crafted     image.(CVE-2016-6161)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php7 fixes the following security issues :

  - CVE-2016-6128: Invalid color index not properly handled     [bsc#987580]

  - CVE-2016-6161: global out of bounds read when encoding     gif from malformed input withgd2togif [bsc#988032]

  - CVE-2016-6292: NULL pointer dereference in     exif_process_user_comment [bsc#991422]

  - CVE-2016-6295: Use after free in SNMP with GC and     unserialize() [bsc#991424]

  - CVE-2016-6297: Stack-based buffer overflow vulnerability     in php_stream_zip_opener [bsc#991426]

  - CVE-2016-6291: Out-of-bounds access in     exif_process_IFD_in_MAKERNOTE [bsc#991427]

  - CVE-2016-6289: Integer overflow leads to buffer overflow     in virtual_file_ex [bsc#991428]

  - CVE-2016-6290: Use after free in unserialize() with     Unexpected Session Deserialization [bsc#991429]

  - CVE-2016-5399: Improper error handling in bzread()     [bsc#991430]

  - CVE-2016-6296: Heap buffer overflow vulnerability in     simplestring_addn in simplestring.c [bsc#991437]

  - CVE-2016-6207: Integer overflow error within
    _gdContributionsAlloc() [bsc#991434]

  - CVE-2016-4473: Invalid free() instead of efree() in     phar_extract_file()

  - CVE-2016-7124: Create an Unexpected Object and Don't     Invoke __wakeup() in Deserialization

  - CVE-2016-7125: PHP Session Data Injection Vulnerability

  - CVE-2016-7126: select_colors write out-of-bounds

  - CVE-2016-7127: imagegammacorrect allowed arbitrary write     access

  - CVE-2016-7128: Memory Leakage In     exif_process_IFD_in_TIFF

  - CVE-2016-7129: wddx_deserialize allowed illegal memory     access

  - CVE-2016-7131: wddx_deserialize null dereference with     invalid xml

  - CVE-2016-7132: wddx_deserialize null dereference in     php_wddx_pop_element

  - CVE-2016-7133: memory allocator fails to realloc small     block to large one

  - CVE-2016-7134: Heap overflow in the function curl_escape

  - CVE-2016-7130: wddx_deserialize null dereference

  - CVE-2016-7413: Use after free in wddx_deserialize

  - CVE-2016-7412: Heap overflow in mysqlnd when not     receiving UNSIGNED_FLAG in BIT field

  - CVE-2016-7417: Missing type check when unserializing     SplArray

  - CVE-2016-7416: Stack based buffer overflow in     msgfmt_format_message

  - CVE-2016-7418: NULL pointer dereference in     php_wddx_push_element

  - CVE-2016-7414: Out of bounds heap read when verifying     signature of zip phar in phar_parse_zipfile

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php5 fixes the following security issues :

  - CVE-2016-6128: Invalid color index not properly handled     [bsc#987580]

  - CVE-2016-6161: global out of bounds read when encoding     gif from malformed input withgd2togif [bsc#988032]

  - CVE-2016-6292: NULL pointer dereference in     exif_process_user_comment [bsc#991422]

  - CVE-2016-6295: Use after free in SNMP with GC and     unserialize() [bsc#991424]

  - CVE-2016-6297: Stack-based buffer overflow vulnerability     in php_stream_zip_opener [bsc#991426]

  - CVE-2016-6291: Out-of-bounds access in     exif_process_IFD_in_MAKERNOTE [bsc#991427]

  - CVE-2016-6289: Integer overflow leads to buffer overflow     in virtual_file_ex [bsc#991428]

  - CVE-2016-6290: Use after free in unserialize() with     Unexpected Session Deserialization [bsc#991429]

  - CVE-2016-5399: Improper error handling in bzread()     [bsc#991430]

  - CVE-2016-6296: Heap buffer overflow vulnerability in     simplestring_addn in simplestring.c [bsc#991437]

  - CVE-2016-6207: Integer overflow error within
    _gdContributionsAlloc() [bsc#991434]

  - CVE-2014-3587: Integer overflow in the     cdf_read_property_info affecting SLES11 SP3 [bsc#987530]

  - CVE-2016-6288: Buffer over-read in php_url_parse_ex     [bsc#991433]

  - CVE-2016-7124: Create an Unexpected Object and Don't     Invoke __wakeup() in Deserialization

  - CVE-2016-7125: PHP Session Data Injection Vulnerability

  - CVE-2016-7126: select_colors write out-of-bounds

  - CVE-2016-7127: imagegammacorrect allowed arbitrary write     access

  - CVE-2016-7128: Memory Leakage In     exif_process_IFD_in_TIFF

  - CVE-2016-7129: wddx_deserialize allowed illegal memory     access

  - CVE-2016-7130: wddx_deserialize null dereference

  - CVE-2016-7131: wddx_deserialize null dereference with     invalid xml

  - CVE-2016-7132: wddx_deserialize null dereference in     php_wddx_pop_element

  - CVE-2016-7134: Heap overflow in the function curl_escape

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The output function in gd_gif_out.c in the GD Graphics Library (aka libgd) allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted image. (CVE-2016-6161)

Security fix for gd.

----

Security fix for CVE-2016-6161

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php5 fixes the following security issues :

  - CVE-2016-6128: Invalid color index not properly handled     [bsc#987580]

  - CVE-2016-6161: global out of bounds read when encoding     gif from malformed input withgd2togif [bsc#988032]

  - CVE-2016-6292: NULL pointer dereference in     exif_process_user_comment [bsc#991422]

  - CVE-2016-6295: Use after free in SNMP with GC and     unserialize() [bsc#991424]

  - CVE-2016-6297: Stack-based buffer overflow vulnerability     in php_stream_zip_opener [bsc#991426]

  - CVE-2016-6291: Out-of-bounds access in     exif_process_IFD_in_MAKERNOTE [bsc#991427]

  - CVE-2016-6289: Integer overflow leads to buffer overflow     in virtual_file_ex [bsc#991428]

  - CVE-2016-6290: Use after free in unserialize() with     Unexpected Session Deserialization [bsc#991429]

  - CVE-2016-5399: Improper error handling in bzread()     [bsc#991430]

  - CVE-2016-6296: Heap buffer overflow vulnerability in     simplestring_addn in simplestring.c [bsc#991437]

  - CVE-2016-6207: Integer overflow error within
    _gdContributionsAlloc() [bsc#991434]

  - CVE-2014-3587: Integer overflow in the     cdf_read_property_info affecting SLES11 SP3 [bsc#987530]

  - CVE-2016-6288: Buffer over-read in php_url_parse_ex     [bsc#991433]

  - CVE-2016-7124: Create an Unexpected Object and Don't     Invoke __wakeup() in Deserialization

  - CVE-2016-7125: PHP Session Data Injection Vulnerability

  - CVE-2016-7126: select_colors write out-of-bounds

  - CVE-2016-7127: imagegammacorrect allowed arbitrary write     access

  - CVE-2016-7128: Memory Leakage In     exif_process_IFD_in_TIFF

  - CVE-2016-7129: wddx_deserialize allowed illegal memory     access

  - CVE-2016-7130: wddx_deserialize null dereference

  - CVE-2016-7131: wddx_deserialize null dereference with     invalid xml

  - CVE-2016-7132: wddx_deserialize null dereference in     php_wddx_pop_element

  - CVE-2016-7134: Heap overflow in the function curl_escape

This update was imported from the SUSE:SLE-12:Update update project.

This update for gd fixes the following issues :

  - CVE-2016-6214: Buffer over-read issue when parsing     crafted TGA file [bsc#991436]

  - CVE-2016-6132: read out-of-bands was found in the     parsing of TGA files using libgd [bsc#987577]

  - CVE-2016-6128: Invalid color index not properly handled     [bsc#991710]

  - CVE-2016-6207: Integer overflow error within
    _gdContributionsAlloc() [bsc#991622]

  - CVE-2016-6161: global out of bounds read when encoding     gif from malformed input withgd2togif [bsc#988032]

  - CVE-2016-5116: avoid stack overflow (read) with large     names [bsc#982176]

  - CVE-2016-6905: Out-of-bounds read in function     read_image_tga in gd_tga.c [bsc#995034]

This update was imported from the SUSE:SLE-12:Update update project.

This update for gd fixes the following issues :

  - CVE-2016-6214: Buffer over-read issue when parsing     crafted TGA file [bsc#991436]

  - CVE-2016-6132: read out-of-bands was found in the     parsing of TGA files using libgd [bsc#987577]

  - CVE-2016-6128: Invalid color index not properly handled     [bsc#991710]

  - CVE-2016-6207: Integer overflow error within
    _gdContributionsAlloc() [bsc#991622]

  - CVE-2016-6161: global out of bounds read when encoding     gif from malformed input withgd2togif [bsc#988032]

  - CVE-2016-5116: avoid stack overflow (read) with large     names [bsc#982176]

  - CVE-2016-6905: Out-of-bounds read in function     read_image_tga in gd_tga.c [bsc#995034]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for gd fixes the following issues :

  - security update :

  - CVE-2016-6161: global out of bounds read when encoding     gif from malformed input withgd2togif [bsc#988032]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for gd fixes the following issues :

  - CVE-2016-6214: Buffer over-read issue when parsing     crafted TGA file [bsc#991436]

  - CVE-2016-6132: read out-of-bands was found in the     parsing of TGA files using libgd [bsc#987577]

  - CVE-2016-6128: Invalid color index not properly handled     [bsc#991710]

  - CVE-2016-6207: Integer overflow error within
    _gdContributionsAlloc() [bsc#991622]

  - CVE-2016-6161: global out of bounds read when encoding     gif from malformed input withgd2togif [bsc#988032]

This update for php5 fixes the following issues :

  - security update :

  - CVE-2016-6128: Invalid color index not properly handled     [bsc#987580]

  - CVE-2016-6161: global out of bounds read when encoding     gif from malformed input withgd2togif [bsc#988032]

  - CVE-2016-6292: NULL pointer dereference in     exif_process_user_comment [bsc#991422]

  - CVE-2016-6295: Use after free in SNMP with GC and     unserialize() [bsc#991424]

  - CVE-2016-6297: Stack-based buffer overflow vulnerability     in php_stream_zip_opener [bsc#991426]

  - CVE-2016-6291: Out-of-bounds access in     exif_process_IFD_in_MAKERNOTE [bsc#991427]

  - CVE-2016-6289: Integer overflow leads to buffer overflow     in virtual_file_ex [bsc#991428]

  - CVE-2016-6290: Use after free in unserialize() with     Unexpected Session Deserialization [bsc#991429]

  - CVE-2016-5399: Improper error handling in bzread()     [bsc#991430]

  - CVE-2016-6296: Heap buffer overflow vulnerability in     simplestring_addn in simplestring.c [bsc#991437]

  - CVE-2016-6207: Integer overflow error within
    _gdContributionsAlloc() [bsc#991434]

  - CVE-2016-6288: Buffer over-read in php_url_parse_ex     [bsc#991433]

A global out of bounds read when encoding gif from malformed input was found in this software.

When given invalid inputs, we might be fed the EOF marker before it is actually the EOF. The gif logic assumes once it sees the EOF marker, there won't be any more data, so it leaves the cur_bits index possibly negative. So when we get more data, we underflow the masks array.

For Debian 7 'Wheezy', these problems have been fixed in version 2.0.36~rc1~dfsg-6.1+deb7u5.

We recommend that you upgrade your libgd2 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in libgd2, a library for programmatic graphics creation and manipulation. A remote attacker can take advantage of these flaws to cause a denial-of-service against an application using the libgd2 library (application crash), or potentially to execute arbitrary code with the privileges of the user running the application.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3030-1 advisory.

    It was discovered that the GD library incorrectly handled memory when using gdImageScaleTwoPass(). A     remote attacker could possibly use this issue to cause a denial of service. This issue only affected     Ubuntu 14.04 LTS. (CVE-2013-7456)

    It was discovered that the GD library incorrectly handled certain malformed XBM images. If a user or     automated system were tricked into processing a specially crafted XBM image, an attacker could cause a     denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 15.10 and Ubuntu 16.04 LTS.
    (CVE-2016-5116)

    It was discovered that the GD library incorrectly handled memory when using _gd2GetHeader(). A remote     attacker could possibly use this issue to cause a denial of service or possibly execute arbitrary code.
    (CVE-2016-5766)

    It was discovered that the GD library incorrectly handled certain color indexes. A remote attacker could     possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu     15.10 and Ubuntu 16.04 LTS. (CVE-2016-6128)

    It was discovered that the GD library incorrectly handled memory when encoding a GIF image. A remote     attacker could possibly use this issue to cause a denial of service. (CVE-2016-6161)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
219947	Linux Distros Unpatched Vulnerability : CVE-2016-6161	Nessus	Misc.	Local	medium
404531	Alpine: gd: security update to 2.2.1-r2	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
404531	Alpine: gd: security update to 2.2.1-r2	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
135626	EulerOS Virtualization 3.0.2.2 : gd (EulerOS-SA-2020-1464)	Nessus	Huawei Local Security Checks	Local	high
132300	EulerOS 2.0 SP3 : gd (EulerOS-SA-2019-2583)	Nessus	Huawei Local Security Checks	Local	critical
131801	EulerOS 2.0 SP5 : gd (EulerOS-SA-2019-2527)	Nessus	Huawei Local Security Checks	Local	medium
131674	EulerOS 2.0 SP2 : gd (EulerOS-SA-2019-2521)	Nessus	Huawei Local Security Checks	Local	critical
119981	SUSE SLES12 Security Update : php7 (SUSE-SU-2016:2460-1)	Nessus	SuSE Local Security Checks	Local	critical
119979	SUSE SLES12 Security Update : php5 (SUSE-SU-2016:2408-1)	Nessus	SuSE Local Security Checks	Local	critical
94923	F5 Networks BIG-IP : libgd vulnerability (K71581599)	Nessus	F5 Networks Local Security Checks	Local	medium
93872	Fedora 23 : gd (2016-0de0e0ee0c)	Nessus	Fedora Local Security Checks	Local	medium
93856	openSUSE Security Update : php5 (openSUSE-2016-1156)	Nessus	SuSE Local Security Checks	Local	critical
93701	openSUSE Security Update : gd (openSUSE-2016-1108)	Nessus	SuSE Local Security Checks	Local	critical
93506	SUSE SLED12 / SLES12 Security Update : gd (SUSE-SU-2016:2303-1)	Nessus	SuSE Local Security Checks	Local	critical
93505	SUSE SLES11 Security Update : gd (SUSE-SU-2016:2302-1)	Nessus	SuSE Local Security Checks	Local	medium
93063	openSUSE Security Update : gd (openSUSE-2016-1003)	Nessus	SuSE Local Security Checks	Local	high
92982	openSUSE Security Update : php5 (openSUSE-2016-985)	Nessus	SuSE Local Security Checks	Local	critical
92570	Debian DLA-563-1 : libgd2 security update	Nessus	Debian Local Security Checks	Local	medium
92327	Debian DSA-3619-1 : libgd2 - security update	Nessus	Debian Local Security Checks	Local	critical
92011	Ubuntu 14.04 LTS / 16.04 LTS : GD library vulnerabilities (USN-3030-1)	Nessus	Ubuntu Local Security Checks	Local	critical

Detections

Analytics

CVE-2016-6161

medium

Tenable Plugins

medium

critical

critical

high

critical

medium

critical

critical

critical

medium

medium

critical

critical

critical

medium

high

critical

medium

critical

critical