CVE-2016-9933: Buffer Overflow
Fixed bug (imagefilltoborder stackoverflow on truecolor images). (CVE-2016-9933)
Other sources
Stack consumption vulnerability in the gdImageFillToBorder function in gd.c in the GD Graphics Library (aka libgd) before 2.2.2, as used in PHP before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (segmentation violation) via a crafted imagefilltoborder call that triggers use of a negative color value.
— MITRE
When negative color values are passed to gdImageFillToBorder(), it can lead to infinite recursion, since the recursion termination condition will not necessarily be met.
Upstream bug:
https://bugs.php.net/bug.php?id=72696
PHP patch:
https://github.com/php/php-src/commit/863d37ea66d5c960db08d6f4a2cbd2518f0f80d1
libgd patch:
https://github.com/libgd/libgd/commit/77f619d48259383628c3ec4654b1ad578e9eb40e
CVE assignment:
http://seclists.org/oss-sec/2016/q4/658
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9933?
CVE-2016-9933 has a severity level that could lead to denial of service due to stack consumption.
How do I fix CVE-2016-9933?
To fix CVE-2016-9933, upgrade to PHP version 5.6.28 or 7.0.13, or GD version 2.2.2 or later.
What software is affected by CVE-2016-9933?
CVE-2016-9933 affects PHP versions prior to 5.6.28 and 7.0.13, as well as GD versions prior to 2.2.2.
Can CVE-2016-9933 be exploited remotely?
Yes, CVE-2016-9933 can be exploited remotely through crafted imagefilltoborder calls.
What type of vulnerability is CVE-2016-9933?
CVE-2016-9933 is classified as a stack consumption vulnerability.