Every CVE Search/ Get API key

CVE-2016-6161

The output function in gd_gif_out.c in the GD Graphics Library (aka libgd) allows remote...

6.5 MediumFix available

CVE-2016-6161 is a medium vulnerability (CVSS 6.5) in Libgd, published July 6, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.89%, the 86th percentile. Fixed in gd 2.2.1-r2.

The output function in gd_gif_out.c in the GD Graphics Library (aka libgd) allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted image.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

2.89%Up 1.6 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.5

The output function in gd_gif_out.c in the GD Graphics Library (aka libgd) allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted image.

Record
CVE-2016-6161
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness
CWE-125
Updated
2026-11-02
CVE List No score

The output function in gd_gif_out.c in the GD Graphics Library (aka libgd) allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted image.

Record
CVE-2016-6161
Updated
2026-11-02
EUVDEUVD-2016-7095 No score

The output function in gd_gif_out.c in the GD Graphics Library (aka libgd) allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted image.

Record
EUVD-2016-7095
Updated
2026-11-03
GitHub AdvisoriesGHSA-gq8p-8q2h-mv7w 6.5

The output function in gd_gif_out.c in the GD Graphics Library (aka libgd) allows remote...

The output function in gd_gif_out.c in the GD Graphics Library (aka libgd) allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted image.

Record
GHSA-gq8p-8q2h-mv7w
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
OSVALPINE-CVE-2016-6161 6.5

The output function in gd_gif_out.c in the GD Graphics Library (aka libgd) allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted image.

Record
ALPINE-CVE-2016-6161
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 6.5

The output function in gd_gif_out.c in the GD Graphics Library (aka libgd) allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted image.

Record
CVE-2016-6161
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 8 moreShow less
OSVDEBIAN-CVE-2016-6161 6.5

The output function in gd_gif_out.c in the GD Graphics Library (aka libgd) allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted image.

Record
DEBIAN-CVE-2016-6161
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2016-6161 6.5

The output function in gd_gif_out.c in the GD Graphics Library (aka libgd) allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted image.

Record
UBUNTU-CVE-2016-6161
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVSUSE-SU-2016:2302-1 No score

Security update for gd

This update for gd fixes the following issues:

  • security update:
    • CVE-2016-6161: global out of bounds read when encoding gif from malformed input withgd2togif [bsc#988032]
Record
SUSE-SU-2016:2302-1
Updated
2026-11-02
OSVSUSE-SU-2016:2303-1 No score

Security update for gd

This update for gd fixes the following issues:

  • CVE-2016-6214: Buffer over-read issue when parsing crafted TGA file [bsc#991436]
  • CVE-2016-6132: read out-of-bands was found in the parsing of TGA files using libgd [bsc#987577]
  • CVE-2016-6128: Invalid color index not properly handled [bsc#991710]
  • CVE-2016-6207: Integer overflow error within _gdContributionsAlloc() [bsc#991622]
  • CVE-2016-6161: global out of bounds read when encoding gif from malformed input withgd2togif [bsc#988032]
  • CVE-2016-5116: avoid stack overflow (read) with large names [bsc#982176]
  • CVE-2016-6905: Out-of-bounds read in function read_image_tga in gd_tga.c [bsc#995034]
Record
SUSE-SU-2016:2303-1
Updated
2026-11-02
OSVSUSE-SU-2016:2408-1 No score

Security update for php5

This update for php5 fixes the following security issues:

  • CVE-2016-6128: Invalid color index not properly handled [bsc#987580]
  • CVE-2016-6161: global out of bounds read when encoding gif from malformed input withgd2togif [bsc#988032]
  • CVE-2016-6292: Null pointer dereference in exif_process_user_comment [bsc#991422]
  • CVE-2016-6295: Use after free in SNMP with GC and unserialize() [bsc#991424]
  • CVE-2016-6297: Stack-based buffer overflow vulnerability in php_stream_zip_opener [bsc#991426]
  • CVE-2016-6291: Out-of-bounds access in exif_process_IFD_in_MAKERNOTE [bsc#991427]
  • CVE-2016-6289: Integer overflow leads to buffer overflow in virtual_file_ex [bsc#991428]
  • CVE-2016-6290: Use after free in unserialize() with Unexpected Session Deserialization [bsc#991429]
  • CVE-2016-5399: Improper error handling in bzread() [bsc#991430]
  • CVE-2016-6296: Heap buffer overflow vulnerability in simplestring_addn in simplestring.c [bsc#991437]
  • CVE-2016-6207: Integer overflow error within _gdContributionsAlloc() [bsc#991434]
  • CVE-2014-3587: Integer overflow in the cdf_read_property_info affecting SLES11 SP3 [bsc#987530]
  • CVE-2016-6288: Buffer over-read in php_url_parse_ex [bsc#991433]
  • CVE-2016-7124: Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization
  • CVE-2016-7125: PHP Session Data Injection Vulnerability
  • CVE-2016-7126: select_colors write out-of-bounds
  • CVE-2016-7127: imagegammacorrect allowed arbitrary write access
  • CVE-2016-7128: Memory Leakage In exif_process_IFD_in_TIFF
  • CVE-2016-7129: wddx_deserialize allowed illegal memory access
  • CVE-2016-7130: wddx_deserialize null dereference
  • CVE-2016-7131: wddx_deserialize null dereference with invalid xml
  • CVE-2016-7132: wddx_deserialize null dereference in php_wddx_pop_element
  • CVE-2016-7134: Heap overflow in the function curl_escape
Record
SUSE-SU-2016:2408-1
Updated
2026-11-02
OSVSUSE-SU-2016:2460-1 No score

Security update for php7

This update for php7 fixes the following security issues:

  • CVE-2016-6128: Invalid color index not properly handled [bsc#987580]
  • CVE-2016-6161: global out of bounds read when encoding gif from malformed input withgd2togif [bsc#988032]
  • CVE-2016-6292: Null pointer dereference in exif_process_user_comment [bsc#991422]
  • CVE-2016-6295: Use after free in SNMP with GC and unserialize() [bsc#991424]
  • CVE-2016-6297: Stack-based buffer overflow vulnerability in php_stream_zip_opener [bsc#991426]
  • CVE-2016-6291: Out-of-bounds access in exif_process_IFD_in_MAKERNOTE [bsc#991427]
  • CVE-2016-6289: Integer overflow leads to buffer overflow in virtual_file_ex [bsc#991428]
  • CVE-2016-6290: Use after free in unserialize() with Unexpected Session Deserialization [bsc#991429]
  • CVE-2016-5399: Improper error handling in bzread() [bsc#991430]
  • CVE-2016-6296: Heap buffer overflow vulnerability in simplestring_addn in simplestring.c [bsc#991437]
  • CVE-2016-6207: Integer overflow error within _gdContributionsAlloc() [bsc#991434]
  • CVE-2016-4473: Invalid free() instead of efree() in phar_extract_file()
  • CVE-2016-7124: Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization
  • CVE-2016-7125: PHP Session Data Injection Vulnerability
  • CVE-2016-7126: select_colors write out-of-bounds
  • CVE-2016-7127: imagegammacorrect allowed arbitrary write access
  • CVE-2016-7128: Memory Leakage In exif_process_IFD_in_TIFF
  • CVE-2016-7129: wddx_deserialize allowed illegal memory access
  • CVE-2016-7131: wddx_deserialize null dereference with invalid xml
  • CVE-2016-7132: wddx_deserialize null dereference in php_wddx_pop_element
  • CVE-2016-7133: memory allocator fails to realloc small block to large one
  • CVE-2016-7134: Heap overflow in the function curl_escape
  • CVE-2016-7130: wddx_deserialize null dereference
  • CVE-2016-7413: Use after free in wddx_deserialize
  • CVE-2016-7412: Heap overflow in mysqlnd when not receiving UNSIGNED_FLAG in BIT field
  • CVE-2016-7417: Missing type check when unserializing SplArray
  • CVE-2016-7416: Stack based buffer overflow in msgfmt_format_message
  • CVE-2016-7418: Null pointer dereference in php_wddx_push_element
  • CVE-2016-7414: Out of bounds heap read when verifying signature of zip phar in phar_parse_zipfile
Record
SUSE-SU-2016:2460-1
Updated
2026-11-02
OSVSUSE-SU-2016:2460-2 No score

Security update for php7

This update for php7 fixes the following security issues:

  • CVE-2016-6128: Invalid color index not properly handled [bsc#987580]
  • CVE-2016-6161: global out of bounds read when encoding gif from malformed input withgd2togif [bsc#988032]
  • CVE-2016-6292: Null pointer dereference in exif_process_user_comment [bsc#991422]
  • CVE-2016-6295: Use after free in SNMP with GC and unserialize() [bsc#991424]
  • CVE-2016-6297: Stack-based buffer overflow vulnerability in php_stream_zip_opener [bsc#991426]
  • CVE-2016-6291: Out-of-bounds access in exif_process_IFD_in_MAKERNOTE [bsc#991427]
  • CVE-2016-6289: Integer overflow leads to buffer overflow in virtual_file_ex [bsc#991428]
  • CVE-2016-6290: Use after free in unserialize() with Unexpected Session Deserialization [bsc#991429]
  • CVE-2016-5399: Improper error handling in bzread() [bsc#991430]
  • CVE-2016-6296: Heap buffer overflow vulnerability in simplestring_addn in simplestring.c [bsc#991437]
  • CVE-2016-6207: Integer overflow error within _gdContributionsAlloc() [bsc#991434]
  • CVE-2016-4473: Invalid free() instead of efree() in phar_extract_file()
  • CVE-2016-7124: Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization
  • CVE-2016-7125: PHP Session Data Injection Vulnerability
  • CVE-2016-7126: select_colors write out-of-bounds
  • CVE-2016-7127: imagegammacorrect allowed arbitrary write access
  • CVE-2016-7128: Memory Leakage In exif_process_IFD_in_TIFF
  • CVE-2016-7129: wddx_deserialize allowed illegal memory access
  • CVE-2016-7131: wddx_deserialize null dereference with invalid xml
  • CVE-2016-7132: wddx_deserialize null dereference in php_wddx_pop_element
  • CVE-2016-7133: memory allocator fails to realloc small block to large one
  • CVE-2016-7134: Heap overflow in the function curl_escape
  • CVE-2016-7130: wddx_deserialize null dereference
  • CVE-2016-7413: Use after free in wddx_deserialize
  • CVE-2016-7412: Heap overflow in mysqlnd when not receiving UNSIGNED_FLAG in BIT field
  • CVE-2016-7417: Missing type check when unserializing SplArray
  • CVE-2016-7416: Stack based buffer overflow in msgfmt_format_message
  • CVE-2016-7418: Null pointer dereference in php_wddx_push_element
  • CVE-2016-7414: Out of bounds heap read when verifying signature of zip phar in phar_parse_zipfile
Record
SUSE-SU-2016:2460-2
Updated
2026-11-02
OSVUSN-3030-1 No score

libgd2 vulnerabilities

It was discovered that the GD library incorrectly handled memory when using gdImageScaleTwoPass(). A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2013-7456)

It was discovered that the GD library incorrectly handled certain malformed XBM images. If a user or automated system were tricked into processing a specially crafted XBM image, an attacker could cause a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 15.10 and Ubuntu 16.04 LTS. (CVE-2016-5116)

It was discovered that the GD library incorrectly handled memory when using _gd2GetHeader(). A remote attacker could possibly use this issue to cause a denial of service or possibly execute arbitrary code. (CVE-2016-5766)

It was discovered that the GD library incorrectly handled certain color indexes. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 15.10 and Ubuntu 16.04 LTS. (CVE-2016-6128)

It was discovered that the GD library incorrectly handled memory when encoding a GIF image. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2016-6161)

Record
USN-3030-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
gd
Alpine:v3.2
 before 2.2.1-r2
2.2.1-r2
gd
Alpine:v3.3
 before 2.2.1-r2
2.2.1-r2
libgd2
Debian:12
 before 2.2.1-1
2.2.1-1
libgd2
Debian:13
 before 2.2.1-1
2.2.1-1
libgd2
Debian:14
 before 2.2.1-1
2.2.1-1
libgd2
Debian:7
 before 2.0.36~rc1~dfsg-6.1+deb7u5, plus listed versions
2.0.36~rc1~dfsg-6.12.0.36~rc1~dfsg-6.1+deb7u12.0.36~rc1~dfsg-6.1+deb7u22.0.36~rc1~dfsg-6.1+deb7u32.0.36~rc1~dfsg-6.1+deb7u4
2.0.36~rc1~dfsg-6.1+deb7u5
libgd2
Debian:8
 before 2.1.0-5+deb8u4, plus listed versions
2.1.0-52.1.0-5+deb8u12.1.0-5+deb8u22.1.0-5+deb8u3
2.1.0-5+deb8u4
gd
SUSE:Linux Enterprise Software Development Kit 11 SP4
 before 2.0.36.RC1-52.22.1
2.0.36.RC1-52.22.1
gd
SUSE:Linux Enterprise Server 11 SP4
 before 2.0.36.RC1-52.22.1
2.0.36.RC1-52.22.1
gd
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
 before 2.0.36.RC1-52.22.1
2.0.36.RC1-52.22.1
Show 11 moreShow less
Affected packages
PackageAffectedFixed
gd
SUSE:Linux Enterprise Desktop 12 SP1
 before 2.1.0-12.1
2.1.0-12.1
gd
SUSE:Linux Enterprise Software Development Kit 12 SP1
 before 2.1.0-12.1
2.1.0-12.1
gd
SUSE:Linux Enterprise Server 12 SP1
 before 2.1.0-12.1
2.1.0-12.1
gd
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
 before 2.1.0-12.1
2.1.0-12.1
gd
SUSE:Linux Enterprise Workstation Extension 12 SP1
 before 2.1.0-12.1
2.1.0-12.1
php5
SUSE:Linux Enterprise Module for Web and Scripting 12
 before 5.5.14-73.1
5.5.14-73.1
php5
SUSE:Linux Enterprise Software Development Kit 12 SP1
 before 5.5.14-73.1
5.5.14-73.1
php7
SUSE:Linux Enterprise Module for Web and Scripting 12
 before 7.0.7-15.1
7.0.7-15.1
php7
SUSE:Linux Enterprise Software Development Kit 12 SP1
 before 7.0.7-15.1
7.0.7-15.1
libgd2
Ubuntu:14.04:LTS
 before 2.1.0-3ubuntu0.2, plus listed versions
2.1.0-22.1.0-32.1.0-3ubuntu0.1
2.1.0-3ubuntu0.2
libgd2
Ubuntu:16.04:LTS
 before 2.1.1-4ubuntu0.16.04.2, plus listed versions
2.1.1-4build12.1.1-4build22.1.1-4ubuntu0.16.04.1
2.1.1-4ubuntu0.16.04.2

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 92 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open