Integer overflow in the gdImageWebpCtx function in gd_webp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP through 7.0.11, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted imagewebp and imagedestroy calls.

The remote NewStart CGSL host, running version MAIN 6.06, has gd packages installed that are affected by multiple vulnerabilities:

  - The GD Graphics Library (aka LibGD) 2.2.5 has a double free in the gdImage*Ptr() functions in     gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c. NOTE: PHP is unaffected. (CVE-2019-6978)

  - The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.x before 5.3.1, and the GD Graphics Library     2.x, does not properly verify a certain colorsTotal structure member, which might allow remote attackers     to conduct buffer overflow or buffer over-read attacks via a crafted GD file, a different vulnerability     than CVE-2009-3293. NOTE: some of these details are obtained from third party information. (CVE-2009-3546)

  - Buffer overflow in the gdImageStringFTEx function in gdft.c in GD Graphics Library 2.0.33 and earlier     allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary     code via a crafted string with a JIS encoded font. (CVE-2007-0455)

  - The gdImageCreateFromXpm function in gdxpm.c in libgd, as used in PHP 5.4.26 and earlier, allows remote     attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted     color table in an XPM file. (CVE-2014-2497)

  - Integer signedness error in GD Graphics Library 2.1.1 (aka libgd or libgd2) allows remote attackers to     cause a denial of service (crash) or potentially execute arbitrary code via crafted compressed gd2 data,     which triggers a heap-based buffer overflow. (CVE-2016-3074)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Integer overflow in the gdImageWebpCtx function in gd_webp.c in the GD Graphics Library (aka libgd)
    through 2.2.3, as used in PHP through 7.0.11, allows remote attackers to cause a denial of service (heap-
    based buffer overflow) or possibly have unspecified other impact via crafted imagewebp and imagedestroy
    calls. (CVE-2016-7568)

This update for php5 fixes the following security issues :

  - CVE-2016-7568: A specially crafted image file could     cause an application crash or potentially execute     arbitrary code when the image is converted to webp     (bsc#1001900)

  - CVE-2016-8670: Stack Buffer Overflow in GD dynamicGetbuf     (bsc#1004924)

  - CVE-2016-6911: Check for out-of-bound read in     dynamicGetbuf() (bsc#1005274)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php7 fixes the following security issue :

  - CVE-2016-7568: A specially crafted image file could     cause an application crash or potentially execute     arbitrary code when the image is converted to webp     (bsc#1001900)

  - CVE-2016-8670: Stack Buffer Overflow in GD dynamicGetbuf     (bsc#1004924)

  - CVE-2016-6911: Check for out-of-bound read in     dynamicGetbuf() (bsc#1005274)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Security fix for CVE-2016-8670

  - Security fix for CVE-2016-6911

  - Security fix for CVE-2016-7568

  - For Fedora 26 disabled two tests - they are failing     because of freetype 2.7     (https://github.com/libgd/libgd/issues/302,     https://github.com/libgd/libgd/issues/217)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201612-09 (GD: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in GD. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update for php5 fixes the following security issues :

  - CVE-2016-7568: A specially crafted image file could     cause an application crash or potentially execute     arbitrary code when the image is converted to webp     (bsc#1001900)

  - CVE-2016-8670: Stack Buffer Overflow in GD dynamicGetbuf     (bsc#1004924)

  - CVE-2016-6911: Check for out-of-bound read in     dynamicGetbuf() (bsc#1005274)

This update was imported from the SUSE:SLE-12:Update update project.

This update for gd fixes the following security issues :

  - CVE-2016-7568: A specially crafted image file could     cause an application crash or potentially execute     arbitrary code when the image is converted to webp     (bsc#1001900)

  - CVE-2016-8670: Stack Buffer Overflow in GD dynamicGetbuf     (bsc#1004924)

  - CVE-2016-6911: Check for out-of-bound read in     dynamicGetbuf() (bsc#1005274)

This update was imported from the SUSE:SLE-12:Update update project.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3117-1 advisory.

    Ibrahim El-Sayed discovered that the GD library incorrectly handled certain malformed Tiff images. If a     user or automated system were tricked into processing a specially crafted Tiff image, an attacker could     cause a denial of service. (CVE-2016-6911)

    Ke Liu discovered that the GD library incorrectly handled certain integers when processing WebP images. If     a user or automated system were tricked into processing a specially crafted WebP image, an attacker could     cause a denial of service, or possibly execute arbitrary code. This issue only applied to Ubuntu 14.04     LTS, Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-7568)

    Emmanuel Law discovered that the GD library incorrectly handled certain strings when creating images. If a     user or automated system were tricked into processing a specially crafted image, an attacker could cause a     denial of service, or possibly execute arbitrary code. (CVE-2016-8670)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for gd fixes the following security issues :

  - CVE-2016-7568: A specially crafted image file could     cause an application crash or potentially execute     arbitrary code when the image is converted to webp     (bsc#1001900)

  - CVE-2016-8670: Stack Buffer Overflow in GD dynamicGetbuf     (bsc#1004924)

  - CVE-2016-6911: Check for out-of-bound read in     dynamicGetbuf() (bsc#1005274)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php5 fixes the following issu :

  - CVE-2016-8670: Stack Buffer Overflow in GD dynamicGetbuf     (bsc#1004924).

  - CVE-2016-7568: Integer overflow in the gdImageWebpCtx     function in gd_webp.c (libgd) (bsc#1001900).

  - CVE-2016-6911: Check for out-of-bound read in     dynamicGetbuf() (bsc#1005274).

This update for gd fixes the following issue :

  - CVE-2016-7568: Integer overflow in the gdImageWebpCtx     function in gd_webp.c (libgd) (bsc#1001900).

Multiple vulnerabilities have been discovered in the GD Graphics Library, which may result in denial of service or potentially the execution of arbitrary code if a malformed file is processed.

ID	Name	Product	Family	Type	Severity
330497	NewStart CGSL MAIN 6.06 : gd Multiple Vulnerabilities (NS-SA-2026-0053)	Nessus	NewStart CGSL Local Security Checks	Local	critical
404534	Alpine: gd: security update to 2.2.3-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
404534	Alpine: gd: security update to 2.2.3-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
401001	Alpine: multiple gd packages, libgd: security update to 2.2.3-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
401001	Alpine: multiple gd packages, libgd: security update to 2.2.3-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
119985	SUSE SLES12 Security Update : php5 (SUSE-SU-2016:2766-1)	Nessus	SuSE Local Security Checks	Local	critical
119984	SUSE SLES12 Security Update : php7 (SUSE-SU-2016:2683-1)	Nessus	SuSE Local Security Checks	Local	critical
96026	Fedora 24 : gd (2016-e45a7e7b13)	Nessus	Fedora Local Security Checks	Local	critical
95678	Fedora 25 : gd (2016-722c0afc64)	Nessus	Fedora Local Security Checks	Local	critical
95524	GLSA-201612-09 : GD: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical
94952	openSUSE Security Update : php5 (openSUSE-2016-1321)	Nessus	SuSE Local Security Checks	Local	critical
94944	openSUSE Security Update : php5 (openSUSE-2016-1308)	Nessus	SuSE Local Security Checks	Local	critical
94753	openSUSE Security Update : gd (openSUSE-2016-1281)	Nessus	SuSE Local Security Checks	Local	critical
94466	Ubuntu 14.04 LTS / 16.04 LTS : GD library vulnerabilities (USN-3117-1)	Nessus	Ubuntu Local Security Checks	Local	critical
94434	SUSE SLED12 / SLES12 Security Update : gd (SUSE-SU-2016:2668-1)	Nessus	SuSE Local Security Checks	Local	critical
94243	openSUSE Security Update : php5 (openSUSE-2016-1221)	Nessus	SuSE Local Security Checks	Local	critical
94242	openSUSE Security Update : gd (openSUSE-2016-1220)	Nessus	SuSE Local Security Checks	Local	critical
94079	Debian DSA-3693-1 : libgd2 - security update	Nessus	Debian Local Security Checks	Local	critical

Detections

Analytics

CVE-2016-7568

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical