CVE-2016-5767

Integer overflow in the gdImageCreate function in gd.c in the GD Graphics Library (aka libgd) before 2.0.34RC1, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted image dimensions.

Stack overflow with imagefilltoborder (CVE-2015-8874).

Integer Overflow in _gd2GetHeader() resulting in heap overflow (CVE-2016-5766).

Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow (CVE-2016-5767).

Improperly handling invalid color index in gdImageCropThreshold() could result in denial of service (CVE-2016-6128).

This update for php5 fixes the following issues:

• It is possible to launch a web server with 'php -S localhost:8080' It used to be possible to set an arbitrary $HTTP_PROXY environment variable for request handlers -- like CGI scripts -- by including a specially crafted HTTP header in the request (CVE-2016-5385). As a result, these server components would potentially direct all their outgoing HTTP traffic through a malicious proxy server. This patch fixes the issue: the updated php server ignores such HTTP headers and never sets $HTTP_PROXY for sub-processes. (bnc#988486)
• There was multiple cases where a remote attacker could trigger a double free and, given specific PHP code using callbacks, trigger code execution vectors. (bnc#986246,bnc#986244,CVE-2016-5768,CVE-2016-5772)
• It was possible to inject header or content information (XSS) when a user was using internet explorer as the browser. (bnc#986004, CVE-2015-8935)
• In several cases it was possible for a integer overflow to trigger an excessive memory allocation (bnc#986392, bnc#986388, bnc#986386, bnc#986393, CVE-2016-5770, CVE-2016-5769, CVE-2016-5766, CVE-2016-5767)
• It was possible for an attacker to abuse the garbage collector to free a target array. At this point an attacker could craft a fake zval object and exploit the PHP process by taking over the EIP/RIP. (bnc#986391, CVE-2016-5771)

php53 was updated to fix five security issues.

These security issues were fixed:

• CVE-2016-5769: mcrypt: Heap Overflow due to integer overflows (bsc#986388).
• CVE-2015-8935: XSS in header() with Internet Explorer (bsc#986004).
• CVE-2016-5772: Double Free Courruption in wddx_deserialize (bsc#986244).
• CVE-2016-5766: Integer Overflow in _gd2GetHeader() resulting in heap overflow (bsc#986386).
• CVE-2016-5767: Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow (bsc#986393).

php5 was updated to fix the following security issues:

• CVE-2016-6297: Stack-based buffer overflow vulnerability in php_stream_zip_opener (bsc#991426).
• CVE-2016-6291: Out-of-bounds access in exif_process_IFD_in_MAKERNOTE (bsc#991427).
• CVE-2016-6289: Integer overflow leads to buffer overflow in virtual_file_ex (bsc#991428).
• CVE-2016-6290: Use after free in unserialize() with Unexpected Session Deserialization (bsc#991429).
• CVE-2016-5399: Improper error handling in bzread() (bsc#991430).
• CVE-2016-6288: Buffer over-read in php_url_parse_ex (bsc#991433).
• CVE-2016-6296: Heap buffer overflow vulnerability in simplestring_addn in simplestring.c (bsc#991437).
• CVE-2016-5769: Mcrypt: Heap Overflow due to integer overflows (bsc#986388).
• CVE-2015-8935: XSS in header() with Internet Explorer (bsc#986004).
• CVE-2016-5772: Double free corruption in wddx_deserialize (bsc#986244).
• CVE-2016-5766: Integer Overflow in _gd2GetHeader() resulting in heap overflow (bsc#986386).
• CVE-2016-5767: Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow (bsc#986393).