CVE-2016-8670: Buffer Overflow
Integer signedness error in the dynamicGetbuf function in gdiodp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted imagecreatefromstring call.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-8670?
CVE-2016-8670 has a medium severity level due to its potential to cause denial of service through a stack-based buffer overflow.
How do I fix CVE-2016-8670?
To fix CVE-2016-8670, upgrade the GD Graphics Library to version 2.2.4 or later, and ensure that PHP is updated to version 5.6.28 or 7.0.13 and above.
Which versions of PHP are affected by CVE-2016-8670?
CVE-2016-8670 affects PHP versions prior to 5.6.28 and 7.x prior to 7.0.13.
What are the potential impacts of CVE-2016-8670?
The potential impacts of CVE-2016-8670 include denial of service attacks and possible undefined behaviors leading to further security risks.
Is there any workaround for CVE-2016-8670?
Currently, the best course of action for CVE-2016-8670 is to apply the updates to the affected software rather than relying on workarounds.