CVE-2016-5767

Integer overflow in the gdImageCreate function in gd.c in the GD Graphics Library (aka libgd) before 2.0.34RC1, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted image dimensions.

References

Affected packages

Git / github.com/libgd/libgd

Affected ranges

Type: GIT
Repo: https://github.com/libgd/libgd
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Git / github.com/libgd/libgd

Affected ranges

Type: GIT
Repo: https://github.com/php/php-src
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

c395c6e5d7e8df37a21265ff76e48fe75ceb5ae6

Affected versions

Other

NEWS

NEWS-cvs2svn

php-5.*

php-5.3.23RC1

php-5.3.29

php-5.3.29RC1

php-5.4.30RC1

php-5.4.32RC1

php-5.4.4RC2

php-5.5.24RC1

Database specific

vanir_signatures

[
    {
        "target": {
            "function": "gdImageCreate",
            "file": "ext/gd/libgd/gd.c"
        },
        "id": "CVE-2016-5767-6bd33d8a",
        "digest": {
            "function_hash": "56026588670328373046956429696843236929",
            "length": 1344.0
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://github.com/php/php-src/commit/c395c6e5d7e8df37a21265ff76e48fe75ceb5ae6",
        "signature_type": "Function"
    }
]