The read_image_tga function in gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA image.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Integer overflow in the gdImageCreate function in gd.c in the GD Graphics Library (aka libgd) before
    2.0.34RC1, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote
    attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have
    unspecified other impact via a crafted image dimensions. (CVE-2016-5767)

  - Stack consumption vulnerability in GD in PHP before 5.6.12 allows remote attackers to cause a denial of
    service via a crafted imagefilltoborder call. (CVE-2015-8874)

  - Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before
    2.2.3, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to
    cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified
    other impact via crafted chunk dimensions in an image. (CVE-2016-5766)

  - The gdImageCropThreshold function in gd_crop.c in the GD Graphics Library (aka libgd) before 2.2.3, as
    used in PHP before 7.0.9, allows remote attackers to cause a denial of service (application crash) via an
    invalid color index. (CVE-2016-6128)

This update for gd fixes the following issues :

  - CVE-2016-6214: Buffer over-read issue when parsing     crafted TGA file [bsc#991436]

  - CVE-2016-6132: read out-of-bands was found in the     parsing of TGA files using libgd [bsc#987577]

  - CVE-2016-6128: Invalid color index not properly handled     [bsc#991710]

  - CVE-2016-6207: Integer overflow error within
    _gdContributionsAlloc() [bsc#991622]

  - CVE-2016-6161: global out of bounds read when encoding     gif from malformed input withgd2togif [bsc#988032]

  - CVE-2016-5116: avoid stack overflow (read) with large     names [bsc#982176]

  - CVE-2016-6905: Out-of-bounds read in function     read_image_tga in gd_tga.c [bsc#995034]

This update was imported from the SUSE:SLE-12:Update update project.

This update for gd fixes the following issues :

  - CVE-2016-6214: Buffer over-read issue when parsing     crafted TGA file [bsc#991436]

  - CVE-2016-6132: read out-of-bands was found in the     parsing of TGA files using libgd [bsc#987577]

  - CVE-2016-6128: Invalid color index not properly handled     [bsc#991710]

  - CVE-2016-6207: Integer overflow error within
    _gdContributionsAlloc() [bsc#991622]

  - CVE-2016-6161: global out of bounds read when encoding     gif from malformed input withgd2togif [bsc#988032]

  - CVE-2016-5116: avoid stack overflow (read) with large     names [bsc#982176]

  - CVE-2016-6905: Out-of-bounds read in function     read_image_tga in gd_tga.c [bsc#995034]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for gd fixes the following issues :

  - Out-of-bounds read in function read_image_tga in     gd_tga.c (CVE-2016-6905, boo#995034)

Several vulnerabilities were discovered in libgd2, a library for programmatic graphics creation and manipulation. A remote attacker can take advantage of these flaws to cause a denial-of-service against an application using the libgd2 library (application crash), or potentially to execute arbitrary code with the privileges of the user running the application.

ID	Name	Product	Family	Severity
400956	Alpine: multiple gd packages, libgd: security update to 2.2.1-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
400956	Alpine: multiple gd packages, libgd: security update to 2.2.1-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
93701	openSUSE Security Update : gd (openSUSE-2016-1108)	Nessus	SuSE Local Security Checks	critical
93506	SUSE SLED12 / SLES12 Security Update : gd (SUSE-SU-2016:2303-1)	Nessus	SuSE Local Security Checks	critical
93248	openSUSE Security Update : gd (openSUSE-2016-1037)	Nessus	SuSE Local Security Checks	medium
92327	Debian DSA-3619-1 : libgd2 - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2016-6905

medium

Tenable Plugins

high

high

critical

critical

medium

critical