CVE-2016-5116 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Libgd

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-200 — Sensitive Information Exposure10 documents7 sources
Severity
9.1CRITICALNVD
OSV7.6
EPSS
2.4%
top 14.94%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Debian Libgd2LibgdDebian Linux+1 more
Timeline
PublishedAug 7
Latest updateMay 14

Description

gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HExploitability: 3.9 | Impact: 5.2

Affected Packages3 packages

▶debiandebian/libgd2< libgd2 2.2.1-1 (bookworm)
▶NVDlibgd/libgd2.2.1
▶NVDopensuse/leap42.1

Also affects: Debian Linux 8.0

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-mvgw-h4r7-8g56: gd_xbm↗2022-05-14
▶
OSV
CVE-2016-5116: gd_xbm↗2016-08-07
▶
OSV
libgd2 vulnerabilities↗2016-07-11
▶

📋Vendor Advisories

3
Ubuntu
GD library vulnerabilities↗2016-07-11
▶
Red Hat
gd: Information leak due to stack overflow in gdCtxPrintf↗2016-05-29
▶
Debian
CVE-2016-5116: libgd2 - gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain...↗2016
▶

💬Community

3
Bugzilla
CVE-2016-5116 gd: Information leak due to stack overflow in gdCtxPrintf [fedora-all]↗2016-05-30
▶
Bugzilla
CVE-2016-5116 gd: Information leak due to stack overflow in gdCtxPrintf↗2016-05-30
▶
Bugzilla
CVE-2016-0750 hotrod client: unchecked deserialization in marshaller util↗2016-01-20
▶