CVE-2016-7127 — Out-of-bounds Write in PHP

CWE-787 — Out-of-bounds Write8 documents7 sources
Severity
9.8CRITICALNVD
EPSS
2.7%
top 14.04%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Php5PHPDebian Libgd2
Timeline
PublishedSep 12
Latest updateMay 14

Description

The imagegammacorrect function in ext/gd/gd.c in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate gamma values, which allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact by providing different signs for the second and third arguments.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶Ubuntuphp5/php5< 5.5.9+dfsg-1ubuntu4.20
▶NVDphp/php5.6.24+10
▶debiandebian/libgd2

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-75cj-4w7q-6p82: The imagegammacorrect function in ext/gd/gd↗2022-05-14
▶
OSV
php5, php7.0 vulnerabilities↗2016-10-04
▶
OSV
CVE-2016-7127: The imagegammacorrect function in ext/gd/gd↗2016-09-11
▶

📋Vendor Advisories

3
Ubuntu
PHP vulnerabilities↗2016-10-04
▶
Red Hat
php: imagegammacorrect allows arbitrary write access↗2016-09-02
▶
Debian
CVE-2016-7127: libgd2 - The imagegammacorrect function in ext/gd/gd.c in PHP before 5.6.25 and 7.x befor...↗2016
▶

💬Community

1
Bugzilla
CVE-2016-7127 php: imagegammacorrect allows arbitrary write access↗2016-09-09
▶
CVE-2016-7127 — Out-of-bounds Write in PHP | cvebase