Improper input validation in GD Graphics Library - CVE-2016-9317

Vulnerability identifier: #VU7572

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-9317

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation when processing overly large images in the gdImageCreate() function in the GD Graphics Library (aka libgd) before 2.2.4. A remote attacker can supply an overly large image and crash the application, using the affected library.

GD Graphics Library
gd (Alpine package)
libwmf
gd
Slackware Linux
Fedora

Update to version 2.2.4.

gd (Alpine package) - update to 2.2.4-r0
libwmf - addressed in versions 0.2.8.4-50.fc24, 0.2.8.4-50.fc25
gd - addressed in versions 2.2.4-1.fc24, 2.2.4-1.fc25

• https://github.com/libgd/libgd/blob/gd-2.2.4/CHANGELOG.md
• https://github.com/libgd/libgd/commit/1846f48e5fcdde996e7c27a4bbac5d0aef183e4b

• Slackware Linux update for gd
• Slackware Linux update for libwmf
• Improper input validation in gd (Alpine package)
• Fedora 25 update for gd
• Fedora 24 update for gd
• Fedora 25 update for libwmf
• Fedora 24 update for libwmf