Detections
Analytics
Alpine: multiple gd packages, libgd: security update to 2.2.1-r0 (deprecated)
high Tenable Cloud Security Plugin ID 400956
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- Integer overflow in the gdImageCreate function in gd.c in the GD Graphics Library (aka libgd) before
2.0.34RC1, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote
attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have
unspecified other impact via a crafted image dimensions. (CVE-2016-5767)
- Stack consumption vulnerability in GD in PHP before 5.6.12 allows remote attackers to cause a denial of
service via a crafted imagefilltoborder call. (CVE-2015-8874)
- Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before
2.2.3, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to
cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified
other impact via crafted chunk dimensions in an image. (CVE-2016-5766)
- The gdImageCropThreshold function in gd_crop.c in the GD Graphics Library (aka libgd) before 2.2.3, as
used in PHP before 7.0.9, allows remote attackers to cause a denial of service (application crash) via an
invalid color index. (CVE-2016-6128)
See Also
https://git.alpinelinux.org/aports/commit/?id=0995182a8c36c3d3624f9e1592b3d0bc47e3242f
https://git.alpinelinux.org/aports/commit/?id=591c7b7c9c9e814f7428e6581fb124e173e0bae2
Plugin Details
Severity: High
ID: 400956
Version: Revision 1.22
Type: Local
Published: 8/16/2023
Updated: 1/17/2024
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2016-5767
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 7.9
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 8/30/2016
Vulnerability Publication Date: 5/16/2016
Reference Information
CVE: CVE-2015-8874, CVE-2016-5766, CVE-2016-5767, CVE-2016-6128, CVE-2016-6132, CVE-2016-6207, CVE-2016-6214, CVE-2016-6905