CVE-2016-7126
CriticalSummary
The imagetruecolortopalette function in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate the number of colors, which may lead to denial of service or other unspecified impacts.
Risk Assessment
Remote attackers can exploit this vulnerability to trigger allocation errors and out-of-bounds writes, potentially affecting application stability.
Recommendation
It is recommended to update PHP to the latest version to mitigate this vulnerability and ensure proper input validation.
Original NVD description (English source)
The imagetruecolortopalette function in ext/gd/gd.c in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate the number of colors, which allows remote attackers to cause a denial of service (select_colors allocation error and out-of-bounds write) or possibly have unspecified other impact via a large value in the third argument.