According to the versions of the gd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Integer signedness error in GD Graphics Library 2.1.1     (aka libgd or libgd2) allows remote attackers to cause     a denial of service (crash) or potentially execute     arbitrary code via crafted compressed gd2 data, which     triggers a heap-based buffer overflow.(CVE-2016-3074)

  - The output function in gd_gif_out.c in the GD Graphics     Library (aka libgd) allows remote attackers to cause a     denial of service (out-of-bounds read) via a crafted     image.(CVE-2016-6161)

  - Stack consumption vulnerability in the     gdImageFillToBorder function in gd.c in the GD Graphics     Library (aka libgd) before 2.2.2, as used in PHP before     5.6.28 and 7.x before 7.0.13, allows remote attackers     to cause a denial of service (segmentation violation)     via a crafted imagefilltoborder call that triggers use     of a negative color value.(CVE-2016-9933)

  - Double free vulnerability in the gdImagePngPtr function     in libgd2 before 2.2.5 allows remote attackers to cause     a denial of service via vectors related to a palette     with no colors.(CVE-2017-6362)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The output function in gd_gif_out.c in the GD Graphics Library (aka libgd) allows remote attackers to     cause a denial of service (out-of-bounds read) via a crafted image. (CVE-2016-6161)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3030-1 advisory.

    It was discovered that the GD library incorrectly handled memory when using gdImageScaleTwoPass(). A     remote attacker could possibly use this issue to cause a denial of service. This issue only affected     Ubuntu 14.04 LTS. (CVE-2013-7456)

    It was discovered that the GD library incorrectly handled certain malformed XBM images. If a user or     automated system were tricked into processing a specially crafted XBM image, an attacker could cause a     denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 15.10 and Ubuntu 16.04 LTS.
    (CVE-2016-5116)

    It was discovered that the GD library incorrectly handled memory when using _gd2GetHeader(). A remote     attacker could possibly use this issue to cause a denial of service or possibly execute arbitrary code.
    (CVE-2016-5766)

    It was discovered that the GD library incorrectly handled certain color indexes. A remote attacker could     possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu     15.10 and Ubuntu 16.04 LTS. (CVE-2016-6128)

    It was discovered that the GD library incorrectly handled memory when encoding a GIF image. A remote     attacker could possibly use this issue to cause a denial of service. (CVE-2016-6161)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for gd fixes the following issues :

  - CVE-2016-6214: Buffer over-read issue when parsing     crafted TGA file [bsc#991436]

  - CVE-2016-6132: read out-of-bands was found in the     parsing of TGA files using libgd [bsc#987577]

  - CVE-2016-6128: Invalid color index not properly handled     [bsc#991710]

  - CVE-2016-6207: Integer overflow error within
    _gdContributionsAlloc() [bsc#991622]

  - CVE-2016-6161: global out of bounds read when encoding     gif from malformed input withgd2togif [bsc#988032]

This update for php5 fixes the following security issues :

  - CVE-2016-6128: Invalid color index not properly handled     [bsc#987580]

  - CVE-2016-6161: global out of bounds read when encoding     gif from malformed input withgd2togif [bsc#988032]

  - CVE-2016-6292: NULL pointer dereference in     exif_process_user_comment [bsc#991422]

  - CVE-2016-6295: Use after free in SNMP with GC and     unserialize() [bsc#991424]

  - CVE-2016-6297: Stack-based buffer overflow vulnerability     in php_stream_zip_opener [bsc#991426]

  - CVE-2016-6291: Out-of-bounds access in     exif_process_IFD_in_MAKERNOTE [bsc#991427]

  - CVE-2016-6289: Integer overflow leads to buffer overflow     in virtual_file_ex [bsc#991428]

  - CVE-2016-6290: Use after free in unserialize() with     Unexpected Session Deserialization [bsc#991429]

  - CVE-2016-5399: Improper error handling in bzread()     [bsc#991430]

  - CVE-2016-6296: Heap buffer overflow vulnerability in     simplestring_addn in simplestring.c [bsc#991437]

  - CVE-2016-6207: Integer overflow error within
    _gdContributionsAlloc() [bsc#991434]

  - CVE-2014-3587: Integer overflow in the     cdf_read_property_info affecting SLES11 SP3 [bsc#987530]

  - CVE-2016-6288: Buffer over-read in php_url_parse_ex     [bsc#991433]

  - CVE-2016-7124: Create an Unexpected Object and Don't     Invoke __wakeup() in Deserialization

  - CVE-2016-7125: PHP Session Data Injection Vulnerability

  - CVE-2016-7126: select_colors write out-of-bounds

  - CVE-2016-7127: imagegammacorrect allowed arbitrary write     access

  - CVE-2016-7128: Memory Leakage In     exif_process_IFD_in_TIFF

  - CVE-2016-7129: wddx_deserialize allowed illegal memory     access

  - CVE-2016-7130: wddx_deserialize null dereference

  - CVE-2016-7131: wddx_deserialize null dereference with     invalid xml

  - CVE-2016-7132: wddx_deserialize null dereference in     php_wddx_pop_element

  - CVE-2016-7134: Heap overflow in the function curl_escape

This update was imported from the SUSE:SLE-12:Update update project.

ID	Name	Product	Family	Published	Updated	Severity
132300	EulerOS 2.0 SP3 : gd (EulerOS-SA-2019-2583)	Nessus	Huawei Local Security Checks	12/19/2019	4/3/2024	critical
219947	Linux Distros Unpatched Vulnerability : CVE-2016-6161	Nessus	Misc.	3/4/2025	7/31/2026	medium
92011	Ubuntu 14.04 LTS / 16.04 LTS : GD library vulnerabilities (USN-3030-1)	Nessus	Ubuntu Local Security Checks	7/12/2016	9/3/2025	critical
93063	openSUSE Security Update : gd (openSUSE-2016-1003)	Nessus	SuSE Local Security Checks	8/22/2016	1/28/2026	high
93856	openSUSE Security Update : php5 (openSUSE-2016-1156)	Nessus	SuSE Local Security Checks	10/5/2016	1/22/2026	critical

Detections

Analytics

Plugins Search

critical

medium

critical

high

critical