CVE-2016-6128: Input Validation
Published Aug 7, 2016
·Updated
The gdImageCropThreshold function in gdcrop.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 7.0.9, allows remote attackers to cause a denial of service (application crash) via an invalid color index.
Affected Software
9 affected components
Debian Debian Linux=8.0
openSUSE Leap=42.1
Libgd Libgd<=2.2.2
PHP PHP>=5.6.0<=5.6.24
PHP PHP>=7.0.0<7.0.9
Canonical Ubuntu Linux=12.04
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=15.10
Canonical Ubuntu Linux=16.04
Remediation
Event History
Aug 7, 2016
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-6128?
CVE-2016-6128 has a medium severity rating due to its potential to cause denial of service attacks.
2
How do I fix CVE-2016-6128?
To fix CVE-2016-6128, upgrade the GD Graphics Library to version 2.2.3 or later.
3
Which versions of PHP are affected by CVE-2016-6128?
CVE-2016-6128 affects PHP versions prior to 7.0.9 and 5.6.x versions before 5.6.24.
4
What are the impacts of CVE-2016-6128 on my application?
The main impact of CVE-2016-6128 is application crashes due to denial of service vulnerabilities.
5
Is CVE-2016-6128 specific to certain operating systems?
CVE-2016-6128 affects specific distributions of Debian, openSUSE, and Ubuntu Linux.