Stack overflow with imagefilltoborder (CVE-2015-8874).
Integer Overflow in _gd2GetHeader() resulting in heap overflow (CVE-2016-5766).
Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow (CVE-2016-5767).
Improperly handling invalid color index in gdImageCropThreshold() could result in denial of service (CVE-2016-6128).