CVE-2016-5116

gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name.

gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name.

Updated libgd packages fix security vulnerabilities:

The gdImageScaleTwoPass function in gd_interpolation.c in libgd before 2.2.0 uses inconsistent allocate and free approaches, which allows remote attackers to cause a denial of service (memory consumption) via a crafted call, as demonstrated by a call to the PHP imagescale function (CVE-2015-8877).

While creating an XBM image (imagexbm) with an user supplied name, libgd before 2.2.0 did not check the vsnprintf return value, so an application might trust this length and read more memory than it should, causing a read-out-of boundaries, leaking stack memory (CVE-2016-5116).

These are all security issues fixed in the gd-2.2.3-2.1 package on the GA media of openSUSE Tumbleweed.

This update for gd fixes the following issues:

• CVE-2016-6214: Buffer over-read issue when parsing crafted TGA file [bsc#991436]
• CVE-2016-6132: read out-of-bands was found in the parsing of TGA files using libgd [bsc#987577]
• CVE-2016-6128: Invalid color index not properly handled [bsc#991710]
• CVE-2016-6207: Integer overflow error within _gdContributionsAlloc() [bsc#991622]
• CVE-2016-6161: global out of bounds read when encoding gif from malformed input withgd2togif [bsc#988032]
• CVE-2016-5116: avoid stack overflow (read) with large names [bsc#982176]
• CVE-2016-6905: Out-of-bounds read in function read_image_tga in gd_tga.c [bsc#995034]

It was discovered that the GD library incorrectly handled memory when using gdImageScaleTwoPass(). A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2013-7456)

It was discovered that the GD library incorrectly handled certain malformed XBM images. If a user or automated system were tricked into processing a specially crafted XBM image, an attacker could cause a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 15.10 and Ubuntu 16.04 LTS. (CVE-2016-5116)

It was discovered that the GD library incorrectly handled memory when using _gd2GetHeader(). A remote attacker could possibly use this issue to cause a denial of service or possibly execute arbitrary code. (CVE-2016-5766)

It was discovered that the GD library incorrectly handled certain color indexes. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 15.10 and Ubuntu 16.04 LTS. (CVE-2016-6128)

It was discovered that the GD library incorrectly handled memory when encoding a GIF image. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2016-6161)