critical
CVE-2016-3074
php: Signedness vulnerability causing heap overflow in libgd
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat5.1AV:N/AC:H/Au:N/C:P/I:P/A:P
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Amazon (high), Red Hat (medium), Ubuntu (medium).
Description
Integer signedness error in GD Graphics Library 2.1.1 (aka libgd or libgd2) allows remote attackers to cause a denial of service (crash) or potentially execute arbitrary code via crafted compressed gd2 data, which triggers a heap-based buffer overflow.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| alpine 3.2 | gd | 2.2.1-r2 |
| alpine 3.3 | gd | 2.2.1-r2 |
| alpine 3.4 | gd | 2.2.1-r0 |
| amazon linux 1 | php55, php55-bcmath, php55-cli and 60 more | 5.5.35-1.114.amzn1 and 1 more |
| debian 11 | libgd2 | 2.1.1-4.1 |
| debian 12 | libgd2 | 2.1.1-4.1 |
| debian 13 | libgd2 | 2.1.1-4.1 |
| debian 14 | libgd2 | 2.1.1-4.1 |
| debian 7 | libgd2 | 2.0.36~rc1~dfsg-6.1+deb7u2 |
| debian 8 | libgd2, php5 | 2.1.0-5+deb8u1 and 1 more |
| echo | libgd2 | 2.1.1-4.1 |
| Red Hat | gd, gd-devel, gd-progs and 28 more | no fix listed |
Show all 111 entries from 18 sources
| Source | Package | Fixed in |
|---|---|---|
| alpine 3.2 | gd | 2.2.1-r2 |
| alpine 3.3 | gd | 2.2.1-r2 |
| alpine 3.4 | gd | 2.2.1-r0 |
| amazon linux 1 | php55 | 5.5.35-1.114.amzn1 |
| amazon linux 1 | php55-bcmath | 5.5.35-1.114.amzn1 |
| amazon linux 1 | php55-cli | 5.5.35-1.114.amzn1 |
| amazon linux 1 | php55-common | 5.5.35-1.114.amzn1 |
| amazon linux 1 | php55-dba | 5.5.35-1.114.amzn1 |
| amazon linux 1 | php55-debuginfo | 5.5.35-1.114.amzn1 |
| amazon linux 1 | php55-devel | 5.5.35-1.114.amzn1 |
| amazon linux 1 | php55-embedded | 5.5.35-1.114.amzn1 |
| amazon linux 1 | php55-enchant | 5.5.35-1.114.amzn1 |
| amazon linux 1 | php55-fpm | 5.5.35-1.114.amzn1 |
| amazon linux 1 | php55-gd | 5.5.35-1.114.amzn1 |
| amazon linux 1 | php55-gmp | 5.5.35-1.114.amzn1 |
| amazon linux 1 | php55-imap | 5.5.35-1.114.amzn1 |
| amazon linux 1 | php55-intl | 5.5.35-1.114.amzn1 |
| amazon linux 1 | php55-ldap | 5.5.35-1.114.amzn1 |
| amazon linux 1 | php55-mbstring | 5.5.35-1.114.amzn1 |
| amazon linux 1 | php55-mcrypt | 5.5.35-1.114.amzn1 |
| amazon linux 1 | php55-mssql | 5.5.35-1.114.amzn1 |
| amazon linux 1 | php55-mysqlnd | 5.5.35-1.114.amzn1 |
| amazon linux 1 | php55-odbc | 5.5.35-1.114.amzn1 |
| amazon linux 1 | php55-opcache | 5.5.35-1.114.amzn1 |
| amazon linux 1 | php55-pdo | 5.5.35-1.114.amzn1 |
| amazon linux 1 | php55-pgsql | 5.5.35-1.114.amzn1 |
| amazon linux 1 | php55-process | 5.5.35-1.114.amzn1 |
| amazon linux 1 | php55-pspell | 5.5.35-1.114.amzn1 |
| amazon linux 1 | php55-recode | 5.5.35-1.114.amzn1 |
| amazon linux 1 | php55-snmp | 5.5.35-1.114.amzn1 |
| amazon linux 1 | php55-soap | 5.5.35-1.114.amzn1 |
| amazon linux 1 | php55-tidy | 5.5.35-1.114.amzn1 |
| amazon linux 1 | php55-xml | 5.5.35-1.114.amzn1 |
| amazon linux 1 | php55-xmlrpc | 5.5.35-1.114.amzn1 |
| amazon linux 1 | php56 | 5.6.21-1.124.amzn1 |
| amazon linux 1 | php56-bcmath | 5.6.21-1.124.amzn1 |
| amazon linux 1 | php56-cli | 5.6.21-1.124.amzn1 |
| amazon linux 1 | php56-common | 5.6.21-1.124.amzn1 |
| amazon linux 1 | php56-dba | 5.6.21-1.124.amzn1 |
| amazon linux 1 | php56-dbg | 5.6.21-1.124.amzn1 |
| amazon linux 1 | php56-debuginfo | 5.6.21-1.124.amzn1 |
| amazon linux 1 | php56-devel | 5.6.21-1.124.amzn1 |
| amazon linux 1 | php56-embedded | 5.6.21-1.124.amzn1 |
| amazon linux 1 | php56-enchant | 5.6.21-1.124.amzn1 |
| amazon linux 1 | php56-fpm | 5.6.21-1.124.amzn1 |
| amazon linux 1 | php56-gd | 5.6.21-1.124.amzn1 |
| amazon linux 1 | php56-gmp | 5.6.21-1.124.amzn1 |
| amazon linux 1 | php56-imap | 5.6.21-1.124.amzn1 |
| amazon linux 1 | php56-intl | 5.6.21-1.124.amzn1 |
| amazon linux 1 | php56-ldap | 5.6.21-1.124.amzn1 |
| amazon linux 1 | php56-mbstring | 5.6.21-1.124.amzn1 |
| amazon linux 1 | php56-mcrypt | 5.6.21-1.124.amzn1 |
| amazon linux 1 | php56-mssql | 5.6.21-1.124.amzn1 |
| amazon linux 1 | php56-mysqlnd | 5.6.21-1.124.amzn1 |
| amazon linux 1 | php56-odbc | 5.6.21-1.124.amzn1 |
| amazon linux 1 | php56-opcache | 5.6.21-1.124.amzn1 |
| amazon linux 1 | php56-pdo | 5.6.21-1.124.amzn1 |
| amazon linux 1 | php56-pgsql | 5.6.21-1.124.amzn1 |
| amazon linux 1 | php56-process | 5.6.21-1.124.amzn1 |
| amazon linux 1 | php56-pspell | 5.6.21-1.124.amzn1 |
| amazon linux 1 | php56-recode | 5.6.21-1.124.amzn1 |
| amazon linux 1 | php56-snmp | 5.6.21-1.124.amzn1 |
| amazon linux 1 | php56-soap | 5.6.21-1.124.amzn1 |
| amazon linux 1 | php56-tidy | 5.6.21-1.124.amzn1 |
| amazon linux 1 | php56-xml | 5.6.21-1.124.amzn1 |
| amazon linux 1 | php56-xmlrpc | 5.6.21-1.124.amzn1 |
| debian 11 | libgd2 | 2.1.1-4.1 |
| debian 12 | libgd2 | 2.1.1-4.1 |
| debian 13 | libgd2 | 2.1.1-4.1 |
| debian 14 | libgd2 | 2.1.1-4.1 |
| debian 7 | libgd2 | 2.0.36~rc1~dfsg-6.1+deb7u2 |
| debian 8 | libgd2 | 2.1.0-5+deb8u1 |
| debian 8 | php5 | 5.6.22+dfsg-0+deb8u1 |
| echo | libgd2 | 2.1.1-4.1 |
| Red Hat | gd | no fix listed |
| Red Hat | gd-devel | no fix listed |
| Red Hat | gd-progs | no fix listed |
| Red Hat | php | no fix listed |
| Red Hat | php-bcmath | no fix listed |
| Red Hat | php-cli | no fix listed |
| Red Hat | php-common | no fix listed |
| Red Hat | php-dba | no fix listed |
| Red Hat | php-devel | no fix listed |
| Red Hat | php-embedded | no fix listed |
| Red Hat | php-enchant | no fix listed |
| Red Hat | php-fpm | no fix listed |
| Red Hat | php-gd | no fix listed |
| Red Hat | php-imap | no fix listed |
| Red Hat | php-intl | no fix listed |
| Red Hat | php-ldap | no fix listed |
| Red Hat | php-mbstring | no fix listed |
| Red Hat | php-mysql | no fix listed |
| Red Hat | php-mysqlnd | no fix listed |
| Red Hat | php-odbc | no fix listed |
| Red Hat | php-pdo | no fix listed |
| Red Hat | php-pgsql | no fix listed |
| Red Hat | php-process | no fix listed |
| Red Hat | php-pspell | no fix listed |
| Red Hat | php-recode | no fix listed |
| Red Hat | php-snmp | no fix listed |
| Red Hat | php-soap | no fix listed |
| Red Hat | php-tidy | no fix listed |
| Red Hat | php-xml | no fix listed |
| Red Hat | php-xmlrpc | no fix listed |
| Red Hat | php-zts | no fix listed |
| ubuntu 12.04 | libgd2 | 2.0.36~rc1~dfsg-6ubuntu2.1 |
| ubuntu 14.04 | libgd2 | 2.1.0-3ubuntu0.1 |
| ubuntu 14.04-ESM | libgd2 | 2.1.0-3ubuntu0.1 |
| ubuntu 15.10 | libgd2 | 2.1.1-4ubuntu0.15.10.1 |
| ubuntu 16.04 | libgd2 | 2.1.1-4ubuntu0.16.04.1 |
| ubuntu 16.04-ESM | libgd2 | 2.1.1-4ubuntu0.16.04.1 |
References
- http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183263.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183724.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00031.html
- http://packetstormsecurity.com/files/136757/libgd-2.1.1-Signedness.html
- http://rhn.redhat.com/errata/RHSA-2016-2750.html
- http://seclists.org/fulldisclosure/2016/Apr/72
- http://www.debian.org/security/2016/dsa-3556
- http://www.debian.org/security/2016/dsa-3602
All 22 references
- http://www.securityfocus.com/archive/1/538160/100/0/threaded
- http://www.securityfocus.com/bid/87087
- http://www.securitytracker.com/id/1035659
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.383127
- http://www.ubuntu.com/usn/USN-2987-1
- https://access.redhat.com/security/cve/CVE-2016-3074
- https://github.com/libgd/libgd/commit/2bb97f407c1145c850416a3bfbcc8cf124e68a19
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731
- https://nvd.nist.gov/vuln/detail/CVE-2016-3074
- https://security.gentoo.org/glsa/201607-04
- https://security.gentoo.org/glsa/201611-22
- https://ubuntu.com/security/notices/USN-2987-1
- https://www.cve.org/CVERecord?id=CVE-2016-3074
- https://www.exploit-db.com/exploits/39736/