CVE-2016-7568

Integer overflow in the gdImageWebpCtx function in gd_webp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP through 7.0.11, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted imagewebp and imagedestroy calls.

Integer overflow in the gdImageWebpCtx function in gd_webp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP through 7.0.11, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted imagewebp and imagedestroy calls.

Integer overflow in the gdImageWebpCtx function in gd_webp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP through 7.0.11, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted imagewebp and imagedestroy calls. (CVE-2016-7568)

This update for gd fixes the following security issues:

• CVE-2016-7568: A specially crafted image file could cause an application crash or potentially execute arbitrary code when the image is converted to webp (bsc#1001900)
• CVE-2016-8670: Stack Buffer Overflow in GD dynamicGetbuf (bsc#1004924)
• CVE-2016-6911: Check for out-of-bound read in dynamicGetbuf() (bsc#1005274)

This update for php7 fixes the following security issue:

• CVE-2016-7568: A specially crafted image file could cause an application crash or potentially execute arbitrary code when the image is converted to webp (bsc#1001900)
• CVE-2016-8670: Stack Buffer Overflow in GD dynamicGetbuf (bsc#1004924)
• CVE-2016-6911: Check for out-of-bound read in dynamicGetbuf() (bsc#1005274)

This update for php7 fixes the following security issue:

• CVE-2016-7568: A specially crafted image file could cause an application crash or potentially execute arbitrary code when the image is converted to webp (bsc#1001900)
• CVE-2016-8670: Stack Buffer Overflow in GD dynamicGetbuf (bsc#1004924)
• CVE-2016-6911: Check for out-of-bound read in dynamicGetbuf() (bsc#1005274)

This update for php5 fixes the following security issues:

• CVE-2016-7568: A specially crafted image file could cause an application crash or potentially execute arbitrary code when the image is converted to webp (bsc#1001900)
• CVE-2016-8670: Stack Buffer Overflow in GD dynamicGetbuf (bsc#1004924)
• CVE-2016-6911: Check for out-of-bound read in dynamicGetbuf() (bsc#1005274)

Ibrahim El-Sayed discovered that the GD library incorrectly handled certain malformed Tiff images. If a user or automated system were tricked into processing a specially crafted Tiff image, an attacker could cause a denial of service. (CVE-2016-6911)

Ke Liu discovered that the GD library incorrectly handled certain integers when processing WebP images. If a user or automated system were tricked into processing a specially crafted WebP image, an attacker could cause a denial of service, or possibly execute arbitrary code. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-7568)

Emmanuel Law discovered that the GD library incorrectly handled certain strings when creating images. If a user or automated system were tricked into processing a specially crafted image, an attacker could cause a denial of service, or possibly execute arbitrary code. (CVE-2016-8670)