CVE-2007-2756

gd / php-gd ImageCreateFromPng infinite loop caused by truncated PNG

The gdPngReadData function in libgd 2.0.34 allows user-assisted attackers to cause a denial of service (CPU consumption) via a crafted PNG image with truncated data, which causes an infinite loop in the png_read_info function in libpng.

CVSS 2.0 · 4.3 Medium EPSS 4.3% KEV · Not listed

Vendors

Libgd Redhat

Products

Libgd Enterprise Linux Rhel Application Stack

CVE-2016-6906

gd: Out-of-bounds read in read_image_tga function

The read_image_tga function in gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file, related to the decompression buffer.

CVSS 3.0 · 5.5 Medium EPSS 2.0% KEV · Not listed

Vendors

Libgd

Products

Libgd

CVE-2016-10166

gd: Unsigned integer underflow _gdContributionsAlloc()

Integer underflow in the _gdContributionsAlloc function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via vectors related to decrementing the u variable.

CVSS 3.0 · 9.8 Critical EPSS 10.7% KEV · Not listed

Vendors

Libgd Redhat

Products

Libgd Rhel Software Collections

CVE-2016-10167

gd: DoS vulnerability in gdImageCreateFromGd2Ctx()

The gdImageCreateFromGd2Ctx function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of service (application crash) via a crafted image file.

CVSS 3.0 · 5.5 Medium EPSS 3.7% KEV · Not listed

Vendors

Libgd Redhat

Products

Libgd Enterprise Linux Rhel Software Collections

CVE-2016-10168

gd: Integer overflow in gd_io.c

Integer overflow in gd_io.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via vectors involving the number of horizontal and vertical chunks in an image.

CVSS 3.0 · 7.8 High EPSS 3.7% KEV · Not listed

Vendors

Libgd Redhat

Products

Libgd Enterprise Linux Rhel Software Collections

CVE-2016-6911

php: Missing check for OOB read in dynamicGetbuf()

The dynamicGetbuf function in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TIFF image.

CVSS 3.0 · 5.5 Medium EPSS 1.8% KEV · Not listed

Vendors

Libgd

Products

Libgd

CVE-2016-6912

php: Double free in gdImageWebpPtr()

Double free vulnerability in the gdImageWebPtr function in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via large width and height values.

CVSS 3.0 · 9.8 Critical EPSS 4.5% KEV · Not listed

Vendors

Libgd

Products

Libgd

CVE-2016-9317

gd: Missing check for oversized images in gdImageCreate()

The gdImageCreate function in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of service (system hang) via an oversized image.

CVSS 3.0 · 5.5 Medium EPSS 3.7% KEV · Not listed

Vendors

Libgd

Products

Libgd

CVE-2017-6362

gd: Double free in the gdImagePngPtr function

Double free vulnerability in the gdImagePngPtr function in libgd2 before 2.2.5 allows remote attackers to cause a denial of service via vectors related to a palette with no colors.

CVSS 3.0 · 7.5 High EPSS 5.1% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 1 more

Products

Ubuntu Linux Debian Linux Fedora and 1 more

CVE-2016-5116

gd: Information leak due to stack overflow in gdCtxPrintf

gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name.

CVSS 3.0 · 9.1 Critical EPSS 3.8% KEV · Not listed

Vendors

Debian Libgd Opensuse and 1 more

Products

Debian Linux Libgd Leap and 1 more

CVE-2016-5767

gd: Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow

Integer overflow in the gdImageCreate function in gd.c in the GD Graphics Library (aka libgd) before 2.0.34RC1, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted image dimensions.

CVSS 3.0 · 8.8 High EPSS 6.7% KEV · Not listed

Vendors

Libgd Php Redhat

Products

Libgd Php Enterprise Linux and 1 more

CVE-2016-6128

gd: Invalid color index not properly handled

The gdImageCropThreshold function in gd_crop.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 7.0.9, allows remote attackers to cause a denial of service (application crash) via an invalid color index.

CVSS 3.1 · 7.5 High EPSS 6.8% KEV · Not listed

Vendors

Canonical Debian Libgd and 3 more

Products

Ubuntu Linux Debian Linux Libgd and 3 more

CVE-2016-6132

gd: Buffer over-read issue when parsing crafted TGA file

The gdImageCreateFromTgaCtx function in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.

CVSS 3.0 · 6.5 Medium EPSS 3.3% KEV · Not listed

Vendors

Debian Libgd Opensuse

Products

Debian Linux Libgd Leap

CVE-2016-6161

gd: Global out-of-bounds read when encoding gif from malformed gd2 input

The output function in gd_gif_out.c in the GD Graphics Library (aka libgd) allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted image.

CVSS 3.0 · 6.5 Medium EPSS 2.9% KEV · Not listed

Vendors

Debian Libgd Opensuse

Products

Debian Linux Libgd Leap

CVE-2016-6207

php,gd: Integer overflow error within _gdContributionsAlloc()

Integer overflow in the _gdContributionsAlloc function in gd_interpolation.c in GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds memory write or memory consumption) via unspecified vectors.

CVSS 3.1 · 6.5 Medium EPSS 6.3% KEV · Not listed

Vendors

Debian Libgd Opensuse and 2 more

Products

Debian Linux Libgd Leap and 2 more

CVE-2016-6214

gd: Buffer over-read issue when parsing crafted TGA file

gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.

CVSS 3.0 · 6.5 Medium EPSS 3.2% KEV · Not listed

Vendors

Debian Libgd Opensuse

Products

Debian Linux Libgd Leap

CVE-2016-6905

gd: Out-of-bounds read in function read_image_tga in gd_tga.c

The read_image_tga function in gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA image.

CVSS 3.0 · 6.5 Medium EPSS 2.6% KEV · Not listed

Vendors

Libgd Opensuse

Products

Libgd Leap Opensuse

CVE-2013-7456

gd: incorrect boundary adjustment in _gdContributionsCalc

gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.1.1, as used in PHP before 5.5.36, 5.6.x before 5.6.22, and 7.x before 7.0.7, allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted image that is mishandled by the imagescale function.

CVSS 3.0 · 7.6 High EPSS 3.8% KEV · Not listed

Vendors

Libgd Php Redhat

Products

Libgd Php Rhel Software Collections

CVE-2016-7568

php: Integer overflow in gdImageWebpCtx

Integer overflow in the gdImageWebpCtx function in gd_webp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP through 7.0.11, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted imagewebp and imagedestroy calls.

CVSS 3.0 · 9.8 Critical EPSS 5.1% KEV · Not listed

Vendors

Debian Libgd Php

Products

Debian Linux Libgd Php

CVE-2016-8670

php: Stack based buffer overflow in dynamicGetbuf

Integer signedness error in the dynamicGetbuf function in gd_io_dp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted imagecreatefromstring call.

CVSS 3.0 · 9.8 Critical EPSS 4.7% KEV · Not listed

Vendors

Libgd Php

Products

Libgd Php