CVE-2016-5116: Buffer Overflow

Q: What is the severity of CVE-2016-5116?

CVE-2016-5116 has been classified as a moderate severity vulnerability due to its potential to cause denial of service and information disclosure.

Q: How do I fix CVE-2016-5116?

To fix CVE-2016-5116, update the GD Graphics Library to version 2.2.0 or later.

Q: What software is affected by CVE-2016-5116?

CVE-2016-5116 affects versions of the GD Graphics Library prior to 2.2.0, particularly when used with certain versions of PHP 5.5.x.

Q: What type of attack can be conducted using CVE-2016-5116?

CVE-2016-5116 allows attackers to perform a denial of service attack or potentially obtain sensitive information by exploiting a buffer under-read.

Q: Are there any specific PHP versions that are vulnerable to CVE-2016-5116?

CVE-2016-5116 is particularly relevant for custom configurations of PHP 5.5.x, where the GD library is used.

Published Aug 7, 2016

Updated

gdxbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name.

Affected Software

49 affected components

Libgd Libgd<=2.2.1

PHP PHP=5.5.0

PHP PHP=5.5.0-alpha1

PHP PHP=5.5.0-alpha2

PHP PHP=5.5.0-alpha3

PHP PHP=5.5.0-alpha4

PHP PHP=5.5.0-alpha5

PHP PHP=5.5.0-alpha6

PHP PHP=5.5.0-beta1

PHP PHP=5.5.0-beta2

PHP PHP=5.5.0-beta3

PHP PHP=5.5.0-beta4

PHP PHP=5.5.0-rc1

PHP PHP=5.5.0-rc2

PHP PHP=5.5.1

PHP PHP=5.5.2

PHP PHP=5.5.3

PHP PHP=5.5.4

PHP PHP=5.5.5

PHP PHP=5.5.6

PHP PHP=5.5.7

PHP PHP=5.5.8

PHP PHP=5.5.9

PHP PHP=5.5.10

PHP PHP=5.5.11

PHP PHP=5.5.12

PHP PHP=5.5.13

PHP PHP=5.5.14

PHP PHP=5.5.18

PHP PHP=5.5.19

PHP PHP=5.5.20

PHP PHP=5.5.21

PHP PHP=5.5.22

PHP PHP=5.5.23

PHP PHP=5.5.24

PHP PHP=5.5.25

PHP PHP=5.5.26

PHP PHP=5.5.27

PHP PHP=5.5.28

PHP PHP=5.5.29

PHP PHP=5.5.30

PHP PHP=5.5.31

PHP PHP=5.5.32

PHP PHP=5.5.33

PHP PHP=5.5.34

PHP PHP=5.5.35

PHP PHP=5.5.37

openSUSE Leap=42.1

Debian Debian Linux=8.0

Remediation

Patch Available

https://github.com/libgd/libgd/commit/4dc1a2d7931017d3625f2d7cff70a17ce58b53b4

Event History

Aug 7, 2016

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2016-5116?

CVE-2016-5116 has been classified as a moderate severity vulnerability due to its potential to cause denial of service and information disclosure.

How do I fix CVE-2016-5116?