Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2016-3074 — Incorrect Conversion between Numeric Types in Libgd2

CWE-681 — Incorrect Conversion between Numeric TypesCWE-122 — Heap-based Buffer Overflow12 documents9 sources
Severity
9.8CRITICALNVD
OSV4.3
EPSS
54.7%
top 1.96%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
7
PHPDebian Libgd2Canonical Ubuntu Linux+4 more
Timeline
PublishedApr 26
Latest updateMay 14

Description

Integer signedness error in GD Graphics Library 2.1.1 (aka libgd or libgd2) allows remote attackers to cause a denial of service (crash) or potentially execute arbitrary code via crafted compressed gd2 data, which triggers a heap-based buffer overflow.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages4 packages

▶debiandebian/libgd2< libgd2 2.1.1-4.1 (bookworm)
▶NVDlibgd/libgd2.1.1
▶NVDphp/php5.5.0 — 5.5.35+2

Also affects: Debian Linux 7.0, 8.0, Fedora 23, 24, Ubuntu Linux 12.04, 14.04, 15.10, 16.04

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
GHSA
GHSA-cqf2-847w-787m: Integer signedness error in GD Graphics Library 2↗2022-05-14
▶
OSV
libgd2 vulnerabilities↗2016-05-31
▶
OSV
CVE-2016-3074: Integer signedness error in GD Graphics Library 2↗2016-04-26
▶
CVEList
CVE-2016-3074: Integer signedness error in GD Graphics Library 2↗2016-04-26
▶

💥Exploits & PoCs

1
Exploit-DB
libgd 2.1.1 - Signedness Heap Overflow↗2016-04-26
▶

📋Vendor Advisories

3
Ubuntu
GD library vulnerabilities↗2016-05-31
▶
Red Hat
php: Signedness vulnerability causing heap overflow in libgd↗2016-04-22
▶
Debian
CVE-2016-3074: libgd2 - Integer signedness error in GD Graphics Library 2.1.1 (aka libgd or libgd2) allo...↗2016
▶

💬Community

3
Bugzilla
CVE-2016-3074 gd: php: Signedness vulnerability causing heap overflow in libgd [fedora-all]↗2016-04-22
▶
Bugzilla
CVE-2016-3074 php: Signedness vulnerability causing heap overflow in libgd [fedora-all]↗2016-04-22
▶
Bugzilla
CVE-2016-3074 php: Signedness vulnerability causing heap overflow in libgd↗2016-03-29
▶