An unsigned integer overflow vulnerability was found in gdContributionsAlloc function.

Upstream patch:

https://github.com/libgd/libgd/commit/60bfb401ad5a4a8ae995dcd36372fe15c71e1a35

CVE assignment:

http://www.openwall.com/lists/oss-security/2017/01/28/6

An integer overflow in gdio.c was found.

Upstream patch:

https://github.com/libgd/libgd/commit/69d2fd2c597ffc0c217de1238b9bf4d4bceba8e6

PHP bug:

https://bugs.php.net/bug.php?id=73869

CVE assignment:

http://www.openwall.com/lists/oss-security/2017/01/28/6

Fixed bug (DOS vulnerability in gdImageCreateFromGd2Ctx()). (CVE-2016-10167)

Integer signedness error in the dynamicGetbuf function in gdiodp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted imagecreatefromstring call.

Integer overflow in the gdImageWebpCtx function in gdwebp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP through 7.0.11, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted imagewebp and imagedestroy calls.

The readimagetga function in gdtga.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file, related to the decompression buffer.