CVE-2016-6912
php: Double free in gdImageWebpPtr()
Einstufung nach Quelle
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut Red Hat (mittel), Ubuntu (mittel).
Beschreibung
Double free vulnerability in the gdImageWebPtr function in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via large width and height values.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| alpine 3.3 | gd | 2.2.4-r0 |
| alpine 3.4 | gd | 2.2.4-r0 |
| alpine 3.5 | gd | 2.2.4-r0 |
| debian 11 | libgd2 | 2.2.4-1 |
| debian 12 | libgd2 | 2.2.4-1 |
| debian 13 | libgd2 | 2.2.4-1 |
| debian 14 | libgd2 | 2.2.4-1 |
| debian 8 | libgd2 | 2.1.0-5+deb8u9 |
| echo | libgd2 | 2.2.4-1 |
| ubuntu 14.04 | libgd2 | 2.1.0-3ubuntu0.6 |
| ubuntu 14.04-ESM | libgd2 | 2.1.0-3ubuntu0.6 |
| ubuntu 16.04 | libgd2 | 2.1.1-4ubuntu0.16.04.6 |
Alle 14 Einträge aus 14 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| alpine 3.3 | gd | 2.2.4-r0 |
| alpine 3.4 | gd | 2.2.4-r0 |
| alpine 3.5 | gd | 2.2.4-r0 |
| debian 11 | libgd2 | 2.2.4-1 |
| debian 12 | libgd2 | 2.2.4-1 |
| debian 13 | libgd2 | 2.2.4-1 |
| debian 14 | libgd2 | 2.2.4-1 |
| debian 8 | libgd2 | 2.1.0-5+deb8u9 |
| echo | libgd2 | 2.2.4-1 |
| ubuntu 14.04 | libgd2 | 2.1.0-3ubuntu0.6 |
| ubuntu 14.04-ESM | libgd2 | 2.1.0-3ubuntu0.6 |
| ubuntu 16.04 | libgd2 | 2.1.1-4ubuntu0.16.04.6 |
| ubuntu 16.04-ESM | libgd2 | 2.1.1-4ubuntu0.16.04.6 |
| ubuntu 16.10 | libgd2 | 2.2.1-1ubuntu3.3 |
Referenzen
- http://www.debian.org/security/2017/dsa-3777
- http://www.securityfocus.com/bid/95843
- https://access.redhat.com/security/cve/CVE-2016-6912
- https://github.com/libgd/libgd/blob/gd-2.2.4/CHANGELOG.md
- https://github.com/libgd/libgd/commit/a49feeae76d41959d85ee733925a4cf40bac61b2
- https://nvd.nist.gov/vuln/detail/CVE-2016-6912
- https://ubuntu.com/security/notices/USN-3213-1
- https://www.cve.org/CVERecord?id=CVE-2016-6912