CVE-2016-6912
php: Double free in gdImageWebpPtr()
Kaynağa göre önem derecesi
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: Red Hat (orta), Ubuntu (orta).
Açıklama
Double free vulnerability in the gdImageWebPtr function in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via large width and height values.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| alpine 3.3 | gd | 2.2.4-r0 |
| alpine 3.4 | gd | 2.2.4-r0 |
| alpine 3.5 | gd | 2.2.4-r0 |
| debian 11 | libgd2 | 2.2.4-1 |
| debian 12 | libgd2 | 2.2.4-1 |
| debian 13 | libgd2 | 2.2.4-1 |
| debian 14 | libgd2 | 2.2.4-1 |
| debian 8 | libgd2 | 2.1.0-5+deb8u9 |
| echo | libgd2 | 2.2.4-1 |
| ubuntu 14.04 | libgd2 | 2.1.0-3ubuntu0.6 |
| ubuntu 14.04-ESM | libgd2 | 2.1.0-3ubuntu0.6 |
| ubuntu 16.04 | libgd2 | 2.1.1-4ubuntu0.16.04.6 |
14 kaynaktaki 14 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| alpine 3.3 | gd | 2.2.4-r0 |
| alpine 3.4 | gd | 2.2.4-r0 |
| alpine 3.5 | gd | 2.2.4-r0 |
| debian 11 | libgd2 | 2.2.4-1 |
| debian 12 | libgd2 | 2.2.4-1 |
| debian 13 | libgd2 | 2.2.4-1 |
| debian 14 | libgd2 | 2.2.4-1 |
| debian 8 | libgd2 | 2.1.0-5+deb8u9 |
| echo | libgd2 | 2.2.4-1 |
| ubuntu 14.04 | libgd2 | 2.1.0-3ubuntu0.6 |
| ubuntu 14.04-ESM | libgd2 | 2.1.0-3ubuntu0.6 |
| ubuntu 16.04 | libgd2 | 2.1.1-4ubuntu0.16.04.6 |
| ubuntu 16.04-ESM | libgd2 | 2.1.1-4ubuntu0.16.04.6 |
| ubuntu 16.10 | libgd2 | 2.2.1-1ubuntu3.3 |
Referanslar
- http://www.debian.org/security/2017/dsa-3777
- http://www.securityfocus.com/bid/95843
- https://access.redhat.com/security/cve/CVE-2016-6912
- https://github.com/libgd/libgd/blob/gd-2.2.4/CHANGELOG.md
- https://github.com/libgd/libgd/commit/a49feeae76d41959d85ee733925a4cf40bac61b2
- https://nvd.nist.gov/vuln/detail/CVE-2016-6912
- https://ubuntu.com/security/notices/USN-3213-1
- https://www.cve.org/CVERecord?id=CVE-2016-6912