Heap-based buffer overflow in libgd - CVE-2016-5766

Vulnerability identifier: #VU32245

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-5766

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8,. A remote attacker can use crafted chunk dimensions in an image. to trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

libgd
Gentoo Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
CentOS
Fedora
gd (Alpine package)
gd (Red Hat package)
gd
Red Hat Advanced Cluster Management for Kubernetes
XtremIO X2

Update to version 2.2.3.

libgd - update to 2.2.3
gd (Alpine package) - update to 2.1.1-r2
gd (Red Hat package) - update to 2.0.35-27.el7_9
gd - addressed in versions 2.1.1-8.fc23, 2.2.2-1.fc24, 2.2.3-1.fc24
Red Hat Advanced Cluster Management for Kubernetes - update to 2.1.3
XtremIO X2 - update to 6.4.1-11

• http://github.com/php/php-src/commit/7722455726bec8c53458a32851d2a87982cf0eac?w=1
• http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00004.html
• http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00025.html
• http://lists.opensuse.org/opensuse-updates/2016-08/msg00003.html
• http://php.net/ChangeLog-5.php
• http://php.net/ChangeLog-7.php
• http://rhn.redhat.com/errata/RHSA-2016-2598.html
• http://rhn.redhat.com/errata/RHSA-2016-2750.html
• http://www.debian.org/security/2016/dsa-3619
• http://www.openwall.com/lists/oss-security/2016/06/23/4
• http://www.ubuntu.com/usn/USN-3030-1
• https://bugs.php.net/bug.php?id=72339
• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731
• https://libgd.github.io/release-2.2.3.html
• https://security.gentoo.org/glsa/201612-09

• Heap-based buffer overflow in libgd
• Heap-based buffer overflow in gd (Alpine package)
• Gentoo update for GD
• Red Hat Enterprise Linux 7 update for gd
• CentOS 7 update for gd
• Multiple vulnerabilities in Dell XtremIO X2
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.1
• Fedora 24 update for gd
• Fedora 23 update for gd
• Fedora 24 update for gd