CVE-2016-6911

The dynamicGetbuf function in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TIFF image.

Ibrahim El-Sayed discovered that the GD library incorrectly handled certain malformed Tiff images. If a user or automated system were tricked into processing a specially crafted Tiff image, an attacker could cause a denial of service (CVE-2016-6911).

Emmanuel Law discovered that the GD library incorrectly handled certain strings when creating images. If a user or automated system were tricked into processing a specially crafted image, an attacker could cause a denial of service, or possibly execute arbitrary code (CVE-2016-8670).

This update for gd fixes the following security issues:

• CVE-2016-7568: A specially crafted image file could cause an application crash or potentially execute arbitrary code when the image is converted to webp (bsc#1001900)
• CVE-2016-8670: Stack Buffer Overflow in GD dynamicGetbuf (bsc#1004924)
• CVE-2016-6911: Check for out-of-bound read in dynamicGetbuf() (bsc#1005274)

This update for gd fixes the following issues:

• CVE-2016-8670: Stack Buffer Overflow in GD dynamicGetbuf (bsc#1004924)
• CVE-2016-6911: Check for out-of-bound read in dynamicGetbuf() (bsc#1005274)

This update for php53 fixes the following issues:

• CVE-2016-8670: Stack Buffer Overflow in GD dynamicGetbuf (bsc#1004924)
• CVE-2016-6911: Check for out-of-bound read in dynamicGetbuf() (bsc#1005274)

This update for php7 fixes the following security issue:

• CVE-2016-7568: A specially crafted image file could cause an application crash or potentially execute arbitrary code when the image is converted to webp (bsc#1001900)
• CVE-2016-8670: Stack Buffer Overflow in GD dynamicGetbuf (bsc#1004924)
• CVE-2016-6911: Check for out-of-bound read in dynamicGetbuf() (bsc#1005274)

This update for php7 fixes the following security issue:

• CVE-2016-7568: A specially crafted image file could cause an application crash or potentially execute arbitrary code when the image is converted to webp (bsc#1001900)
• CVE-2016-8670: Stack Buffer Overflow in GD dynamicGetbuf (bsc#1004924)
• CVE-2016-6911: Check for out-of-bound read in dynamicGetbuf() (bsc#1005274)

This update for php5 fixes the following security issues:

• CVE-2016-7568: A specially crafted image file could cause an application crash or potentially execute arbitrary code when the image is converted to webp (bsc#1001900)
• CVE-2016-8670: Stack Buffer Overflow in GD dynamicGetbuf (bsc#1004924)
• CVE-2016-6911: Check for out-of-bound read in dynamicGetbuf() (bsc#1005274)

Ibrahim El-Sayed discovered that the GD library incorrectly handled certain malformed Tiff images. If a user or automated system were tricked into processing a specially crafted Tiff image, an attacker could cause a denial of service. (CVE-2016-6911)

Ke Liu discovered that the GD library incorrectly handled certain integers when processing WebP images. If a user or automated system were tricked into processing a specially crafted WebP image, an attacker could cause a denial of service, or possibly execute arbitrary code. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-7568)

Emmanuel Law discovered that the GD library incorrectly handled certain strings when creating images. If a user or automated system were tricked into processing a specially crafted image, an attacker could cause a denial of service, or possibly execute arbitrary code. (CVE-2016-8670)