Integer overflow in GD Graphics Library - CVE-2016-10168

Vulnerability identifier: #VU7576

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-10168

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack and potentially compromise vulnerable system.

The vulnerability exists due to integer overflow when processing the number of horizontal and vertical chunks in an image in gd_io.c. A remote attacker create a specially crafted image file, trigger memory corruption and crash the affected application or execute arbitrary code on the target system.

GD Graphics Library
Amazon Linux AMI
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power
SUSE Linux
Slackware Linux
Fedora
gd (Alpine package)
libwmf

Update to version 2.2.4.

gd (Alpine package) - update to 2.2.4-r0
libwmf - addressed in versions 0.2.8.4-50.fc24, 0.2.8.4-50.fc25

• https://github.com/libgd/libgd/blob/gd-2.2.4/CHANGELOG.md

• Slackware Linux update for gd
• Red Hat update for libgd
• Slackware Linux update for libwmf
• Red Hat update for php
• Slackware Linux update for php
• Amazon Linux AMI update for php56
• Amazon Linux AMI update for php70
• SUSE Linux update for php53
• Integer overflow in gd (Alpine package)
• Fedora 25 update for libwmf
• Fedora 24 update for libwmf