{"id":"CVE-2016-5116","aliases":["ALPINE-CVE-2016-5116","DEBIAN-CVE-2016-5116","DSA-3619-1","EUVD-2016-6067","GHSA-mvgw-h4r7-8g56","MGASA-2016-0215","SUSE-SU-2016:2303-1","UBUNTU-CVE-2016-5116","USN-3030-1","openSUSE-SU-2024:10062-1"],"status":"published","title":"gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x...","description":"gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name.","severity":{"version":"3.0","score":9.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03809,"percentile":0.90102,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2016-05-30T00:00:00Z","modified":"2026-10-24T14:05:45Z","fixes":[{"ecosystem":"Alpine:v3.2","package":"gd","fixed_in":["2.2.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.3","package":"gd","fixed_in":["2.2.1-r2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libgd2","fixed_in":["2.2.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libgd2","fixed_in":["2.2.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libgd2","fixed_in":["2.2.1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"libgd2","fixed_in":["2.1.0-3ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"libgd2","fixed_in":["2.1.1-4ubuntu0.16.04.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.2","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.3","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-r2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libgd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libgd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libgd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"libgd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-5+deb8u4"}]}],"versions":["2.1.0-5","2.1.0-5+deb8u1","2.1.0-5+deb8u2","2.1.0-5+deb8u3"],"bundled":7},{"source":"osv","ecosystem":"Mageia:5","package":"libgd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-1.2.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-12.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-12.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-12.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-12.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP1","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-12.1"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libgd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-3ubuntu0.2"}]}],"versions":["2.1.0-2","2.1.0-3","2.1.0-3ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libgd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-4ubuntu0.16.04.2"}]}],"versions":["2.1.1-4build1","2.1.1-4build2","2.1.1-4ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libgd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-3ubuntu0.2"}]}],"versions":["2.1.0-2","2.1.0-3","2.1.0-3ubuntu0.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libgd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-4ubuntu0.16.04.2"}]}],"versions":["2.1.1-4build1","2.1.1-4build2","2.1.1-4ubuntu0.16.04.1"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3-2.1"}]}],"bundled":8}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"libgd","product":"libgd"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"http://lists.opensuse.org/opensuse-updates/2016-09/msg00078.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/libgd/libgd/issues/211","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"http://www.openwall.com/lists/oss-security/2016/05/29/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","article"]},{"url":"http://www.debian.org/security/2016/dsa-3619","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-3030-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"https://github.com/libgd/libgd/commit/4dc1a2d7931017d3625f2d7cff70a17ce58b53b4","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5116"},{"url":"https://github.com/advisories/GHSA-mvgw-h4r7-8g56"},{"url":"https://security.alpinelinux.org/vuln/CVE-2016-5116","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-5116","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0215.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=18562","tags":["report"]},{"url":"https://www.debian.org/security/2016/dsa-3587","tags":["web"]},{"url":"http://openwall.com/lists/oss-security/2016/05/29/5","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162303-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/982176","tags":["report"]},{"url":"https://bugzilla.suse.com/987577","tags":["report"]},{"url":"https://bugzilla.suse.com/988032","tags":["report"]},{"url":"https://bugzilla.suse.com/991436","tags":["report"]},{"url":"https://bugzilla.suse.com/991622","tags":["report"]},{"url":"https://bugzilla.suse.com/991710","tags":["report"]},{"url":"https://bugzilla.suse.com/995034","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5116","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6905","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-5116","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2016/05/29/3","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3030-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5116","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-7456","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5766","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-6128","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-6161","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5766","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-5116","description":"gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name.","status":"published","published":"2016-08-07T10:00:00Z","modified":"2024-08-06T00:53:47.352Z","updated_at":"2026-11-02T14:33:30.767029Z"}],"euvd":[{"id":"EUVD-2016-6067","description":"gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name.","status":"published","published":"2016-08-07T10:00:00Z","modified":"2024-08-06T00:53:47Z","updated_at":"2026-11-03T02:22:43.959327Z"}],"ghsa":[{"id":"GHSA-mvgw-h4r7-8g56","title":"gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x...","description":"gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name.","status":"published","published":"2022-05-14T02:12:14Z","modified":"2023-02-02T05:05:21Z","cvss":[{"version":"3.0","score":9.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:52:06.092141Z"}],"nvd":[{"id":"CVE-2016-5116","description":"gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name.","status":"published","published":"2016-08-07T10:59:12.257Z","modified":"2026-06-17T00:48:47.07Z","cvss":[{"version":"3.0","score":9.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:03:28.854267Z"}],"osv":[{"id":"ALPINE-CVE-2016-5116","description":"gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name.","status":"published","published":"2016-08-07T10:59:12.257Z","modified":"2026-09-22T06:30:21.960638249Z","cvss":[{"version":"3.0","score":9.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:46.318571Z"},{"id":"CVE-2016-5116","description":"gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name.","status":"published","published":"2016-08-07T10:59:12.257Z","modified":"2026-10-24T14:05:45.593533889Z","cvss":[{"version":"3.0","score":9.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:02.454775Z"},{"id":"DEBIAN-CVE-2016-5116","description":"gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name.","status":"published","published":"2016-08-07T10:59:12.257Z","modified":"2026-09-22T07:01:53.292466501Z","cvss":[{"version":"3.0","score":9.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:27.627285Z"},{"id":"UBUNTU-CVE-2016-5116","description":"gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name.","status":"published","published":"2016-05-30T00:00:00Z","modified":"2026-04-22T10:47:25.067009Z","cvss":[{"version":"3.0","score":9.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:12.261906Z"},{"id":"DSA-3619-1","title":"libgd2 - security update","status":"published","published":"2016-07-15T00:00:00Z","modified":"2026-03-09T01:18:02.770224Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2016-0215","title":"Updated libgd packages fix security vulnerabilities","description":"Updated libgd packages fix security vulnerabilities:\n\nThe gdImageScaleTwoPass function in gd_interpolation.c in libgd before 2.2.0\nuses inconsistent allocate and free approaches, which allows remote attackers\nto cause a denial of service (memory consumption) via a crafted call, as\ndemonstrated by a call to the PHP imagescale function (CVE-2015-8877).\n\nWhile creating an XBM image (imagexbm) with an user supplied name, libgd before\n2.2.0 did not check the vsnprintf return value, so an application might trust\nthis length and read more memory than it should, causing a read-out-of\nboundaries, leaking stack memory (CVE-2016-5116).\n","status":"published","published":"2016-06-02T21:40:03Z","modified":"2026-04-16T06:24:06.385428894Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2024:10062-1","title":"gd-2.2.3-2.1 on GA media","description":"These are all security issues fixed in the gd-2.2.3-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:35:02.411178Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"SUSE-SU-2016:2303-1","title":"Security update for gd","description":"\nThis update for gd fixes the following issues:\n\n  * CVE-2016-6214: Buffer over-read issue when parsing crafted TGA file [bsc#991436]\n  * CVE-2016-6132: read out-of-bands was found in the parsing of TGA files using libgd [bsc#987577]\n  * CVE-2016-6128: Invalid color index not properly handled [bsc#991710]\n  * CVE-2016-6207: Integer overflow error within _gdContributionsAlloc() [bsc#991622]\n  * CVE-2016-6161: global out of bounds read when encoding gif from malformed input withgd2togif [bsc#988032]\n  * CVE-2016-5116: avoid stack overflow (read) with large names [bsc#982176]\n  * CVE-2016-6905: Out-of-bounds read in function read_image_tga in gd_tga.c [bsc#995034]\n\n","status":"published","published":"2016-09-14T07:12:19Z","modified":"2026-02-04T03:56:49.945768Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"USN-3030-1","title":"libgd2 vulnerabilities","description":"It was discovered that the GD library incorrectly handled memory when using\ngdImageScaleTwoPass(). A remote attacker could possibly use this issue to\ncause a denial of service. This issue only affected Ubuntu 14.04 LTS.\n(CVE-2013-7456)\n\nIt was discovered that the GD library incorrectly handled certain malformed\nXBM images. If a user or automated system were tricked into processing a\nspecially crafted XBM image, an attacker could cause a denial of service.\nThis issue only affected Ubuntu 14.04 LTS, Ubuntu 15.10 and Ubuntu 16.04\nLTS. (CVE-2016-5116)\n\nIt was discovered that the GD library incorrectly handled memory when using\n_gd2GetHeader(). A remote attacker could possibly use this issue to cause a\ndenial of service or possibly execute arbitrary code. (CVE-2016-5766)\n\nIt was discovered that the GD library incorrectly handled certain color\nindexes. A remote attacker could possibly use this issue to cause a denial\nof service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 15.10 and\nUbuntu 16.04 LTS. (CVE-2016-6128)\n\nIt was discovered that the GD library incorrectly handled memory when\nencoding a GIF image. A remote attacker could possibly use this issue to\ncause a denial of service. (CVE-2016-6161)\n","status":"published","published":"2016-07-11T16:47:45Z","modified":"2026-04-22T09:25:54.897263Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}