CVE-2016-5767: Buffer Overflow

Q: What is the severity of CVE-2016-5767?

CVE-2016-5767 has a high severity, as it can lead to denial of service through a heap-based buffer overflow.

Q: How do I fix CVE-2016-5767?

To fix CVE-2016-5767, upgrade to PHP versions 7.0.8 or newer, or GD Graphics Library version 2.0.34RC1 or newer.

Q: Which versions of PHP are affected by CVE-2016-5767?

PHP versions below 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 are affected by CVE-2016-5767.

Q: Is there a workaround for CVE-2016-5767?

There are no known effective workarounds for CVE-2016-5767; upgrading to patched versions is recommended.

Q: What type of vulnerability is CVE-2016-5767 classified as?

CVE-2016-5767 is classified as a remote denial of service vulnerability due to integer overflow.

Published Aug 7, 2016

Updated

Integer overflow in the gdImageCreate function in gd.c in the GD Graphics Library (aka libgd) before 2.0.34RC1, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted image dimensions.

Other sources

Fixed bug (Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow). (CVE-2016-5767)

— PHP

Affected Software

42 affected componentsFixes available

Libgd Libgd<=2.0.33

PHP PHP<=5.5.36

PHP PHP=5.6.0-alpha1

PHP PHP=5.6.0-alpha2

PHP PHP=5.6.0-alpha3

PHP PHP=5.6.0-alpha4

PHP PHP=5.6.0-alpha5

PHP PHP=5.6.0-beta1

PHP PHP=5.6.0-beta2

PHP PHP=5.6.0-beta3

PHP PHP=5.6.0-beta4

PHP PHP=5.6.1

PHP PHP=5.6.2

PHP PHP=5.6.3

PHP PHP=5.6.4

PHP PHP=5.6.5

PHP PHP=5.6.6

PHP PHP=5.6.7

PHP PHP=5.6.8

PHP PHP=5.6.9

PHP PHP=5.6.10

PHP PHP=5.6.11

PHP PHP=5.6.12

PHP PHP=5.6.13

PHP PHP=5.6.14

PHP PHP=5.6.15

PHP PHP=5.6.16

PHP PHP=5.6.17

PHP PHP=5.6.18

PHP PHP=5.6.19

PHP PHP=5.6.20

PHP PHP=5.6.21

PHP PHP=5.6.22

PHP PHP=7.0.0

PHP PHP=7.0.1

PHP PHP=7.0.2

PHP PHP=7.0.3

PHP PHP=7.0.4

PHP PHP=7.0.5

PHP PHP=7.0.6

PHP PHP=7.0.7

PHP PHP<7.0.8

7.0.8

Event History

Aug 7, 2016

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2016-5767?

CVE-2016-5767 has a high severity, as it can lead to denial of service through a heap-based buffer overflow.

How do I fix CVE-2016-5767?