CVE-2016-7126: Critical severity php vulnerability
The imagetruecolortopalette function in ext/gd/gd.c in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate the number of colors, which allows remote attackers to cause a denial of service (selectcolors allocation error and out-of-bounds write) or possibly have unspecified other impact via a large value in the third argument.
Other sources
Fixed bug (selectcolors write out-of-bounds). (CVE-2016-7126)
— PHP
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-7126?
CVE-2016-7126 has a severity rating that indicates the potential for denial of service due to an allocation error and out-of-bounds write.
How do I fix CVE-2016-7126?
To fix CVE-2016-7126, upgrade your PHP installation to version 5.6.25 or later, or version 7.0.10 or later.
Which versions of PHP are affected by CVE-2016-7126?
CVE-2016-7126 affects PHP versions prior to 5.6.25 and 7.0.10, including versions 5.6.24 and earlier for the 5.x series, and 7.0.9 and earlier for the 7.x series.
What are the potential impacts of CVE-2016-7126?
The potential impacts of CVE-2016-7126 include denial of service attacks caused by allocation errors or out-of-bounds writes.
Who can exploit CVE-2016-7126?
CVE-2016-7126 can be exploited by remote attackers to trigger denial of service vulnerabilities.