CVE-2016-5766

Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via crafted chunk dimensions in an image.

Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via crafted chunk dimensions in an image.

• Fix bug #69720: Null pointer dereference in phar_get_fp_offset()
• Fix bug #70728: Type Confusion Vulnerability in PHP_to_XMLRPC_worker()
• Fix bug #70661: Use After Free Vulnerability in WDDX Packet Deserialization
• Fix bug #70741: Session WDDX Packet Deserialization Type Confusion Vulnerability
• Fix bug #71459: Integer overflow in iptcembed()
• Fix bug #71039: exec functions ignore length but look for NULL termination
• Fix bug #71354: Heap corruption in tar/zip/phar parser.
• Fix bug #71391: NULL Pointer Dereference in phar_tar_setupmetadata()
• Fix bug #71323: Output of stream_get_meta_data can be falsified by its input
• Fix bug #71498: Out-of-Bound Read in phar_parse_zipfile()
• Fix bug #71587: Use-After-Free / Double-Free in WDDX Deserialize
• Fix bug #71860: Invalid memory write in phar on filename with \0 in name
• Fix bug #71798: Integer Overflow in php_raw_url_encode
• Fix bug #72837: integer overflow in bzdecompress caused heap corruption
• Fix bug #72681: PHP Session Data Injection Vulnerability
• Fix bug #72807: integer overflow in curl_escape caused heap corruption
• Fix bug #72838: Integer overflow lead to heap corruption in sql_regcase
• Fix bug #72697: select_colors write out-of-bounds
• Fix bug #72730: imagegammacorrect allows arbitrary write access
• Fix bug #72836: integer overflow in base64_decode caused heap corruption
• Fix bug #72848: integer overflow in quoted_printable_encode caused heap corruption
• Fix bug #72849: integer overflow in urlencode caused heap corruption
• Fix bug #72850: integer overflow in php_uuencode caused heap corruption
• Fix bug #72771: ftps:// wrapper is vulnerable to protocol downgrade attack
• Fix bug #72749: wddx_deserialize allows illegal memory access
• Fix bug #72750: wddx_deserialize null dereference
• Fix bug #72790: wddx_deserialize null dereference with invalid xml
• Fix bug #72799: wddx_deserialize null dereference in php_wddx_pop_element
• Fix bug #73189: Memcpy negative size parameter php_resolve_path
• Fix bug #73150: missing NULL check in dom_document_save_html
• Fix bug #73284: heap overflow in php_ereg_replace function
• Fix bug #73218: stack-buffer-overflow through "ResourceBundle" methods
• Fix bug #73208: integer overflow in imap_8bit caused heap corruption
• Fix bug #73082: string length overflow in mb_encode_* function
• Fix bug #73174: heap overflow in php_pcre_replace_impl
• Fix bug #73276: crash in openssl_random_pseudo_bytes function
• Fix bug #73275: crash in openssl_encrypt function
• Fix bug #73017: memory corruption in wordwrap function
• Fix bug #73240: Write out of bounds at number_format
• Fix bug #73073: CachingIterator null dereference when convert to string
• Fix bug #73293: NULL pointer dereference in SimpleXMLElement::asXML()
• Fix bug #73356: crash in bzcompress function
• Fix bug #72696: imagefilltoborder stackoverflow on truecolor images
• Fix bug #73418: Integer Overflow in "_php_imap_mail" leads Heap Overflow
• Fix bug #73144: Use-after-free in ArrayObject Deserialization
• Fix bug #73192: parse_url return wrong hostname
• Fix bug #73331: NULL Pointer Dereference in WDDX Packet Deserialization with PDORow
• Fix bug #73452: Segfault (Regression for #69152)
• Fix bug #73631: Invalid read when wddx decodes empty boolean element
• Fix bug #67587: Redirection loop on nginx with FPM
• Fix bug #71465: PHAR doesn't know about litespeed
• Fix bug #73737: FPE when parsing a tag format
• Fix bug #73868: Fix DOS vulnerability in gdImageCreateFromGd2Ctx()
• Fix bug #73869: Signed Integer Overflow gd_io.c
• Fix bug #73773: Seg fault when loading hostile phar
• Fix bug #70436: Use After Free Vulnerability in unserialize()
• Fix bug #74603: PHP INI Parsing Stack Buffer Overflow Vulnerability
• Fix bug #72535: arcfour encryption stream filter crashes php
• Fix bug #72434: ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unseria
• Fix bug #72455: Heap Overflow due to integer overflows
• Fix bug #74782:…

Stack overflow with imagefilltoborder (CVE-2015-8874).

Integer Overflow in _gd2GetHeader() resulting in heap overflow (CVE-2016-5766).

Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow (CVE-2016-5767).

Improperly handling invalid color index in gdImageCropThreshold() could result in denial of service (CVE-2016-6128).

These are all security issues fixed in the gd-2.2.3-2.1 package on the GA media of openSUSE Tumbleweed.

This update for php5 fixes the following issues:

• It is possible to launch a web server with 'php -S localhost:8080' It used to be possible to set an arbitrary $HTTP_PROXY environment variable for request handlers -- like CGI scripts -- by including a specially crafted HTTP header in the request (CVE-2016-5385). As a result, these server components would potentially direct all their outgoing HTTP traffic through a malicious proxy server. This patch fixes the issue: the updated php server ignores such HTTP headers and never sets $HTTP_PROXY for sub-processes. (bnc#988486)
• There was multiple cases where a remote attacker could trigger a double free and, given specific PHP code using callbacks, trigger code execution vectors. (bnc#986246,bnc#986244,CVE-2016-5768,CVE-2016-5772)
• It was possible to inject header or content information (XSS) when a user was using internet explorer as the browser. (bnc#986004, CVE-2015-8935)
• In several cases it was possible for a integer overflow to trigger an excessive memory allocation (bnc#986392, bnc#986388, bnc#986386, bnc#986393, CVE-2016-5770, CVE-2016-5769, CVE-2016-5766, CVE-2016-5767)
• It was possible for an attacker to abuse the garbage collector to free a target array. At this point an attacker could craft a fake zval object and exploit the PHP process by taking over the EIP/RIP. (bnc#986391, CVE-2016-5771)

php53 was updated to fix five security issues.

These security issues were fixed:

• CVE-2016-5769: mcrypt: Heap Overflow due to integer overflows (bsc#986388).
• CVE-2015-8935: XSS in header() with Internet Explorer (bsc#986004).
• CVE-2016-5772: Double Free Courruption in wddx_deserialize (bsc#986244).
• CVE-2016-5766: Integer Overflow in _gd2GetHeader() resulting in heap overflow (bsc#986386).
• CVE-2016-5767: Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow (bsc#986393).

php5 was updated to fix the following security issues:

• CVE-2016-6297: Stack-based buffer overflow vulnerability in php_stream_zip_opener (bsc#991426).
• CVE-2016-6291: Out-of-bounds access in exif_process_IFD_in_MAKERNOTE (bsc#991427).
• CVE-2016-6289: Integer overflow leads to buffer overflow in virtual_file_ex (bsc#991428).
• CVE-2016-6290: Use after free in unserialize() with Unexpected Session Deserialization (bsc#991429).
• CVE-2016-5399: Improper error handling in bzread() (bsc#991430).
• CVE-2016-6288: Buffer over-read in php_url_parse_ex (bsc#991433).
• CVE-2016-6296: Heap buffer overflow vulnerability in simplestring_addn in simplestring.c (bsc#991437).
• CVE-2016-5769: Mcrypt: Heap Overflow due to integer overflows (bsc#986388).
• CVE-2015-8935: XSS in header() with Internet Explorer (bsc#986004).
• CVE-2016-5772: Double free corruption in wddx_deserialize (bsc#986244).
• CVE-2016-5766: Integer Overflow in _gd2GetHeader() resulting in heap overflow (bsc#986386).
• CVE-2016-5767: Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow (bsc#986393).

This update for php7 fixes the following issues:

• CVE-2016-10397: parse_url() can be bypassed to return fake host. (bsc#1047454)
• CVE-2017-11142: Remoteattackers could cause a CPU consumption denial of service attack by injectinglong form variables, related to main/php_variables. (bsc#1048100)
• CVE-2017-11144: The opensslextension PEM sealing code did not check the return value of the OpenSSL sealingfunction, which could lead to a crash. (bsc#1048096)
• CVE-2017-11145: Lack of bounds checks in timelib_meridian coud lead to information leak. (bsc#1048112)
• CVE-2017-11146: Lack of bounds checks in timelib_meridian parse code could lead to information leak. (bsc#1048111)
• CVE-2017-11147: The PHAR archive handler could beused by attackers supplying malicious archive files to crash the PHP interpreteror potentially disclose information. (bsc#1048094)
• CVE-2017-11628: Stack-base dbuffer overflow in zend_ini_do_op() could lead to denial of service (bsc#1050726)
• CVE-2017-7890: Buffer over-read from unitialized data in gdImageCreateFromGifCtx function could lead to denial of service (bsc#1050241)
• CVE-2016-5766: Integer Overflow in _gd2GetHeader() resulting in heap overflow could lead to denial of service or code execution (bsc#986386)

Other fixes:

• Soap Request with References (bsc#1053645)
• php7-pear should explicitly require php7-pear-Archive_Tar otherwise this dependency must be declared in every php7-pear-* package explicitly. [bnc#1052389]

This update for php5 fixes the following issues:

• CVE-2016-10397: parse_url() can be bypassed to return fake host. (bsc#1047454)
• CVE-2017-11143: An invalid free in the WDDX deserialization of booleanparameters could be used by attackers able to inject XML for deserialization tocrash the PHP interpreter. (bsc#1048097)
• CVE-2017-11144: The opensslextension PEM sealing code did not check the return value of the OpenSSL sealingfunction, which could lead to a crash. (bsc#1048096)
• CVE-2017-11145: Lack of bounds checks in timelib_meridian coud lead to information leak. (bsc#1048112)
• CVE-2017-11146: Lack of bounds checks in timelib_meridian parse code could lead to information leak. (bsc#1048111)
• CVE-2017-11147: The PHAR archive handler could beused by attackers supplying malicious archive files to crash the PHP interpreteror potentially disclose information. (bsc#1048094)
• CVE-2016-5766: Integer Overflow in _gd2GetHeader() resulting could lead to heap overflow (bsc#986386)
• CVE-2017-11628: Stack-base dbuffer overflow in zend_ini_do_op() in Zend/zend_ini_parser.c (bsc#1050726)
• CVE-2017-7890: Buffer over-read from unitialized data in gdImageCreateFromGifCtx function could lead to denial of service (bsc#1050241)

This update for php53 fixes the several issues.

These security issues were fixed:

• CVE-2017-12933: The finish_nested_data function in ext/standard/var_unserializer.re was prone to a buffer over-read while unserializing untrusted data. Exploitation of this issue could have had an unspecified impact on the integrity of PHP (bsc#1054430).
• CVE-2017-11628: Stack-based buffer overflow in the zend_ini_do_op() function in Zend/zend_ini_parser.c could have caused a denial of service or potentially allowed executing code (bsc#1050726).
• CVE-2017-7890: The GIF decoding function gdImageCreateFromGifCtx in the GD Graphics Library did not zero colorMap arrays use. A specially crafted GIF image could use the uninitialized tables to read ~700 bytes from the top of the stack, potentially disclosing sensitive information (bsc#1050241).
• CVE-2016-5766: Integer overflow in the _gd2GetHeader in the GD Graphics Library (aka libgd) allowed remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via crafted chunk dimensions in an image (bsc#986386).
• CVE-2017-11145: An error in the date extension's timelib_meridian parsing code could have been used by attackers able to supply date strings to leak information from the interpreter, related to ext/date/lib/parse_date.c out-of-bounds reads affecting the php_parse_date function (bsc#1048112).
• CVE-2017-11146: Lack of bounds checks in timelib_meridian parse code could have lead to information leak [bsc#1048111]
• CVE-2016-10397: Incorrect handling of various URI components in the URL parser could have been used by attackers to bypass hostname-specific URL checks (bsc#1047454).
• CVE-2017-11147: The PHAR archive handler could have been used by attackers supplying malicious archive files to crash the PHP interpreter or potentially disclose information due to a buffer over-read in the phar_parse_pharfile function (bsc#1048094).
• CVE-2017-11144: The openssl extension PEM sealing code did not check the return value of the OpenSSL sealing function, which could have lead to a crash of the PHP interpreter (bsc#1048096).

It was discovered that the GD library incorrectly handled memory when using gdImageScaleTwoPass(). A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2013-7456)

It was discovered that the GD library incorrectly handled certain malformed XBM images. If a user or automated system were tricked into processing a specially crafted XBM image, an attacker could cause a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 15.10 and Ubuntu 16.04 LTS. (CVE-2016-5116)

It was discovered that the GD library incorrectly handled memory when using _gd2GetHeader(). A remote attacker could possibly use this issue to cause a denial of service or possibly execute arbitrary code. (CVE-2016-5766)

It was discovered that the GD library incorrectly handled certain color indexes. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 15.10 and Ubuntu 16.04 LTS. (CVE-2016-6128)

It was discovered that the GD library incorrectly handled memory when encoding a GIF image. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2016-6161)