CVE-2016-10168: Integer Overflow
An integer overflow in gdio.c was found.
Upstream patch:
https://github.com/libgd/libgd/commit/69d2fd2c597ffc0c217de1238b9bf4d4bceba8e6
PHP bug:
https://bugs.php.net/bug.php?id=73869
CVE assignment:
http://www.openwall.com/lists/oss-security/2017/01/28/6
Other sources
Fixed bug (Signed Integer Overflow gdio.c). (CVE-2016-10168)
— PHP
Integer overflow in gdio.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via vectors involving the number of horizontal and vertical chunks in an image.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-10168?
CVE-2016-10168 has a medium severity rating due to the potential for integer overflow vulnerabilities.
How do I fix CVE-2016-10168?
To fix CVE-2016-10168, upgrade the GD Graphics Library to version 2.2.4 or higher.
What systems are affected by CVE-2016-10168?
CVE-2016-10168 affects versions of the GD Graphics Library prior to 2.2.4 and certain versions of PHP.
What types of attacks could exploit CVE-2016-10168?
An attacker could exploit CVE-2016-10168 by crafting a malicious image that triggers integer overflow, leading to potential denial of service.
Is CVE-2016-10168 still a concern for modern systems?
Although CVE-2016-10168 has been patched, systems running outdated versions may still be at risk if not updated.