Integer underflow in GD Graphics Library - CVE-2016-10166

Vulnerability identifier: #VU7574

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-10166

CWE-ID: CWE-191

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack and potentially compromise vulnerable system.

The vulnerability exists due to integer underflow when decrementing the "u" variable in _gdContributionsAlloc() function in gd_interpolation.c. A remote attacker create a specially crafted image file, trigger memory corruption and crash the affected application or execute arbitrary code on the target system.

GD Graphics Library
Red Hat Software Collections
gd (Alpine package)
php5 (Alpine package)
php7 (Alpine package)
libwmf
PHP
SUSE Linux
Slackware Linux
Fedora

Update to version 2.2.4.

gd (Alpine package) - update to 2.2.4-r0
PHP - addressed in versions 5.6.40, 7.1.26, 7.2.14, 7.3.1
php5 (Alpine package) - update to 5.6.40-r0
php7 (Alpine package) - update to 7.1.30-r0
libwmf - addressed in versions 0.2.8.4-50.fc24, 0.2.8.4-50.fc25

• https://github.com/libgd/libgd/blob/gd-2.2.4/CHANGELOG.md

• Slackware Linux update for gd
• Multiple vulnerabilities in PHP
• SUSE Linux update for php53
• Red Hat update for rh-php72-php
• Integer underflow in php5 (Alpine package)
• Integer underflow in php7 (Alpine package)
• Integer underflow in gd (Alpine package)
• Fedora 25 update for libwmf
• Fedora 24 update for libwmf