CVE-2016-5767

High

Published: 07/08/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Integer overflow in the gdImageCreate function in the GD Graphics Library before version 2.0.34RC1, used in PHP before versions 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via crafted image dimensions.

Risk Assessment

Organizations may experience application crashes and potential service outages, leading to data loss or reputational damage.

Recommendation

It is recommended to update the GD library to version 2.0.34RC1 or later and PHP to versions 5.5.37, 5.6.23, or 7.0.8 to minimize risk.

Other vulnerabilities in GD Graphics Library (libgd) oraz PHP

CVE-2016-5766High
Integer overflow in the _gd2GetHeader function in the GD Graphics Library (libgd) before version 2.2.3, as used in PHP before version 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via crafted chunk dimensions in an image.

Original NVD description (English source)

Integer overflow in the gdImageCreate function in gd.c in the GD Graphics Library (aka libgd) before 2.0.34RC1, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted image dimensions.