GD Graphics Library (libgd) vulnerabilities
8 known CVE vulnerabilities in GD Graphics Library (libgd), translated and rated.
- CVE-2016-10168High
Integer overflow in gd_io.c in the GD Graphics Library (libgd) before version 2.2.4 allows remote attackers to have unspecified impact via manipulation of the number of horizontal and vertical chunks in an image.
- CVE-2016-9933High
A stack consumption vulnerability exists in the gdImageFillToBorder function in the GD Graphics Library (libgd) before version 2.2.2. This allows remote attackers to cause a denial of service (segmentation violation) via a crafted imagefilltoborder call that triggers the use of a negative color value.
- CVE-2013-7456High
In the GD Graphics Library (libgd) before version 2.1.1, used in PHP before version 5.5.36, 5.6.x before 5.6.22, and 7.x before 7.0.7, there is a vulnerability that allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted image mishandled by the imagescale function.
- CVE-2016-10166Critical
An integer underflow in the _gdContributionsAlloc function in the GD Graphics Library (libgd) before version 2.2.4 allows remote attackers to have unspecified impact via manipulation of the u variable.
- CVE-2016-6912Critical
A double free vulnerability in the gdImageWebPtr function in the GD Graphics Library (libgd) before version 2.2.4 allows remote attackers to have unspecified impact via large width and height values.
- CVE-2016-8670Critical
Integer signedness error in the dynamicGetbuf function in the GD Graphics Library (libgd) through version 2.2.3, used in PHP before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted imagecreatefromstring call.
- CVE-2016-7568Critical
Integer overflow in the gdImageWebpCtx function in the GD Graphics Library (libgd) through version 2.2.3, used in PHP through version 7.0.11, can lead to denial of service (heap-based buffer overflow) or other unspecified impacts via crafted imagewebp and imagedestroy calls.
- CVE-2016-5116Critical
In the GD Graphics Library (libgd) before version 2.2.0, there is a vulnerability that allows attackers to obtain sensitive information from process memory or cause application crashes via a long name.