Updated php and libgd packages fix security vulnerabilities

Buffer over-read into uninitialized memory in libgd CVE-2017-7890. Security issues from bundled oniguruma in php-mbstring CVE-2017-9224, CVE-2017-9226, CVE-2017-9227, CVE-2017-9228, CVE-2017-9229...

CVE-2017-7890: Exposure of Sensitive Information to an Unauthorized Actor

The GIF decoding function gdImageCreateFromGifCtx in gdgifin.c in the GD Graphics Library aka libgd, as used in PHP before 5.6.31 and 7.x before 7.1.7, does not zero colorMap arrays before use. A specially crafted GIF image could use the uninitialized tables to read 700 bytes from the top of the...

CVE-2017-7890

The GIF decoding function gdImageCreateFromGifCtx in gdgifin.c in the GD Graphics Library aka libgd, as used in PHP before 5.6.31 and 7.x before 7.1.7, does not zero colorMap arrays before use. A specially crafted GIF image could use the uninitialized tables to read 700 bytes from the top of the...

Juniper Junos libgd Compressed GD2 Data RCE (JSA10798)

According to its self-reported version number, the remote Juniper Junos device is affected by an integer signedness error in the included GD Graphics Library libgd when handling compressed GD2 data due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit...

LibGD security advisory [18 January 2017]

The LibGD project released advisories on January 18th, 2017, July 22nd, 2016 and June 25th, 2016 describing 12 vulnerabilities, as listed below:...

PHP 5.6.x < 5.6.31 Multiple Vulnerabilities

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.31. It is, therefore, affected by the following vulnerabilities : - An out-of-bounds read error exists in the PCRE library in the compilebracketmatchingpath function within file pcrejitcompile.c. An...

Amazon Linux AMI : php56 (ALAS-2017-808)

Integer overflow in gdio.c in the GD Graphics Library aka libgd before 2.2.4 allows remote attackers to have unspecified impact via vectors involving the number of horizontal and vertical chunks in an image.CVE-2016-10168 The objectcommon1 function in ext/standard/varunserializer.c in PHP before...

CVE-2016-10166

Integer underflow in the gdContributionsAlloc function in gdinterpolation.c in the GD Graphics Library aka libgd before 2.2.4 allows remote attackers to have unspecified impact via vectors related to decrementing the u variable...

Code injection

The gdImageCreateFromGd2Ctx function in gdgd2.c in the GD Graphics Library aka libgd before 2.2.4 allows remote attackers to cause a denial of service application crash via a crafted image file...

Integer overflow

Integer underflow in the gdContributionsAlloc function in gdinterpolation.c in the GD Graphics Library aka libgd before 2.2.4 allows remote attackers to have unspecified impact via vectors related to decrementing the u variable...

CVE-2016-10166

CVE-2016-10166 affects libgd (GD Graphics Library). The vulnerability is an integer underflow in _gdContributionsAlloc in gd_interpolation.c, exploited via inputs that decrement the u variable, and affects libgd up to versions before 2.2.4. Public advisories describe potential impact including de...

CVE-2016-10166

Integer underflow in the gdContributionsAlloc function in gdinterpolation.c in the GD Graphics Library aka libgd before 2.2.4 allows remote attackers to have unspecified impact via vectors related to decrementing the u variable...

CVE-2016-10166

Integer underflow in the gdContributionsAlloc function in gdinterpolation.c in the GD Graphics Library aka libgd before 2.2.4 allows remote attackers to have unspecified impact via vectors related to decrementing the u variable...

CVE-2016-10167

The gdImageCreateFromGd2Ctx function in gdgd2.c in the GD Graphics Library aka libgd before 2.2.4 allows remote attackers to cause a denial of service application crash via a crafted image file...

CVE-2016-10168

Integer overflow in gdio.c in the GD Graphics Library aka libgd before 2.2.4 allows remote attackers to have unspecified impact via vectors involving the number of horizontal and vertical chunks in an image...

CVE-2016-10167

The CVE-2016-10167 issue affects the GD Graphics Library (libgd): the function gdImageCreateFromGd2Ctx in gd_gd2.c, affected up to version 2.2.3, can be exploited by a crafted GD2 file to cause an application crash and thus a denial of service. The vulnerability is triggered when processing such ...

CVE-2016-10167

The gdImageCreateFromGd2Ctx function in gdgd2.c in the GD Graphics Library aka libgd before 2.2.4 allows remote attackers to cause a denial of service application crash via a crafted image file...

CVE-2016-10168

CVE-2016-10168 is a vulnerability in the GD Graphics Library (libgd) where an integer overflow in gd_io.c (prior to 2.2.4) can be triggered by crafted images. Affected: libgd before 2.2.4. Impact described as unspecified in the NVD entry; several advisories reiterate that an attacker could cause ...

CVE-2016-6906

The readimagetga function in gdtga.c in the GD Graphics Library aka libgd before 2.2.4 allows remote attackers to cause a denial of service out-of-bounds read via a crafted TGA file, related to the decompression buffer...

CVE-2016-6906

CVE-2016-6906 affects the GD Graphics Library (libgd) read_image_tga in gd_tga.c, vulnerable before 2.2.4 due to an out-of-bounds read in the TGA decompression buffer when processing crafted images. This can cause denial of service; potential for remote impact is indicated in related advisories, ...