Ibrahim El-Sayed discovered that the GD library incorrectly handled certain malformed Tiff images. If a user or automated system were tricked into processing a specially crafted Tiff image, an attacker could cause a denial of service. (CVE-2016-6911)

Ke Liu discovered that the GD library incorrectly handled certain integers when processing WebP images. If a user or automated system were tricked into processing a specially crafted WebP image, an attacker could cause a denial of service, or possibly execute arbitrary code. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-7568)

Emmanuel Law discovered that the GD library incorrectly handled certain strings when creating images. If a user or automated system were tricked into processing a specially crafted image, an attacker could cause a denial of service, or possibly execute arbitrary code.
(CVE-2016-8670).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php5 fixes the following security issues :

  - CVE-2016-7568: A specially crafted image file could     cause an application crash or potentially execute     arbitrary code when the image is converted to webp     (bsc#1001900)

  - CVE-2016-8670: Stack Buffer Overflow in GD dynamicGetbuf     (bsc#1004924)

  - CVE-2016-6911: Check for out-of-bound read in     dynamicGetbuf() (bsc#1005274)

This update was imported from the SUSE:SLE-12:Update update project.

Multiple vulnerabilities have been discovered in the GD Graphics Library, which may result in denial of service or potentially the execution of arbitrary code if a malformed file is processed.

This update for php5 fixes the following issu :

  - CVE-2016-8670: Stack Buffer Overflow in GD dynamicGetbuf     (bsc#1004924).

  - CVE-2016-7568: Integer overflow in the gdImageWebpCtx     function in gd_webp.c (libgd) (bsc#1001900).

  - CVE-2016-6911: Check for out-of-bound read in     dynamicGetbuf() (bsc#1005274).

This update for php5 fixes the following security issues :

  - CVE-2016-7568: A specially crafted image file could     cause an application crash or potentially execute     arbitrary code when the image is converted to webp     (bsc#1001900)

  - CVE-2016-8670: Stack Buffer Overflow in GD dynamicGetbuf     (bsc#1004924)

  - CVE-2016-6911: Check for out-of-bound read in     dynamicGetbuf() (bsc#1005274)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for gd fixes the following issue :

  - CVE-2016-7568: Integer overflow in the gdImageWebpCtx     function in gd_webp.c (libgd) (bsc#1001900).

The remote host is affected by the vulnerability described in GLSA-201612-09 (GD: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in GD. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update for gd fixes the following security issues :

  - CVE-2016-7568: A specially crafted image file could     cause an application crash or potentially execute     arbitrary code when the image is converted to webp     (bsc#1001900)

  - CVE-2016-8670: Stack Buffer Overflow in GD dynamicGetbuf     (bsc#1004924)

  - CVE-2016-6911: Check for out-of-bound read in     dynamicGetbuf() (bsc#1005274)

This update was imported from the SUSE:SLE-12:Update update project.

This update for php7 fixes the following security issue :

  - CVE-2016-7568: A specially crafted image file could     cause an application crash or potentially execute     arbitrary code when the image is converted to webp     (bsc#1001900)

  - CVE-2016-8670: Stack Buffer Overflow in GD dynamicGetbuf     (bsc#1004924)

  - CVE-2016-6911: Check for out-of-bound read in     dynamicGetbuf() (bsc#1005274)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for gd fixes the following security issues :

  - CVE-2016-7568: A specially crafted image file could     cause an application crash or potentially execute     arbitrary code when the image is converted to webp     (bsc#1001900)

  - CVE-2016-8670: Stack Buffer Overflow in GD dynamicGetbuf     (bsc#1004924)

  - CVE-2016-6911: Check for out-of-bound read in     dynamicGetbuf() (bsc#1005274)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Security fix for CVE-2016-8670

  - Security fix for CVE-2016-6911

  - Security fix for CVE-2016-7568

  - For Fedora 26 disabled two tests - they are failing     because of freetype 2.7     (https://github.com/libgd/libgd/issues/302,     https://github.com/libgd/libgd/issues/217)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
94466	Ubuntu 14.04 LTS / 16.04 LTS : GD library vulnerabilities (USN-3117-1)	Nessus	Ubuntu Local Security Checks	11/2/2016	10/20/2023	critical
94944	openSUSE Security Update : php5 (openSUSE-2016-1308)	Nessus	SuSE Local Security Checks	11/18/2016	1/19/2021	critical
94079	Debian DSA-3693-1 : libgd2 - security update	Nessus	Debian Local Security Checks	10/17/2016	1/11/2021	critical
94243	openSUSE Security Update : php5 (openSUSE-2016-1221)	Nessus	SuSE Local Security Checks	10/25/2016	1/19/2021	critical
119985	SUSE SLES12 Security Update : php5 (SUSE-SU-2016:2766-1)	Nessus	SuSE Local Security Checks	1/2/2019	1/6/2021	critical
94242	openSUSE Security Update : gd (openSUSE-2016-1220)	Nessus	SuSE Local Security Checks	10/25/2016	1/19/2021	critical
95524	GLSA-201612-09 : GD: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	12/5/2016	1/11/2021	critical
94753	openSUSE Security Update : gd (openSUSE-2016-1281)	Nessus	SuSE Local Security Checks	11/14/2016	1/19/2021	critical
119984	SUSE SLES12 Security Update : php7 (SUSE-SU-2016:2683-1)	Nessus	SuSE Local Security Checks	1/2/2019	1/6/2021	critical
94434	SUSE SLED12 / SLES12 Security Update : gd (SUSE-SU-2016:2668-1)	Nessus	SuSE Local Security Checks	10/31/2016	1/6/2021	critical
94952	openSUSE Security Update : php5 (openSUSE-2016-1321)	Nessus	SuSE Local Security Checks	11/18/2016	1/19/2021	critical
95678	Fedora 25 : gd (2016-722c0afc64)	Nessus	Fedora Local Security Checks	12/12/2016	1/11/2021	critical
96026	Fedora 24 : gd (2016-e45a7e7b13)	Nessus	Fedora Local Security Checks	12/20/2016	1/11/2021	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical