CVE-2016-8670
CriticalSummary
Integer signedness error in the dynamicGetbuf function in the GD Graphics Library (libgd) through version 2.2.3, used in PHP before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted imagecreatefromstring call.
Risk Assessment
Organizations may be exposed to attacks leading to denial of service, affecting application availability. Additionally, there is a risk of unspecified impacts that could threaten system integrity.
Recommendation
It is recommended to update PHP to version 5.6.28 or 7.0.13 and later to mitigate this vulnerability. Also, monitor applications using the GD Graphics Library for potential attack attempts.
Original NVD description (English source)
Integer signedness error in the dynamicGetbuf function in gd_io_dp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted imagecreatefromstring call.