CVE-2016-6207 : Integer overflow in the _gdContributionsAlloc function in gd_interpolation.c in GD Graphics Library (aka libgd) before 2

Integer overflow in the _gdContributionsAlloc function in gd_interpolation.c in GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds memory write or memory consumption) via unspecified vectors.

Published 2016-08-12 15:59:04

Updated 2022-08-29 20:04:35

Source MITRE

View at NVD, CVE.org

Vulnerability category: OverflowMemory CorruptionDenial of service

Threat overview for CVE-2016-6207

Top countries where our scanners detected CVE-2016-6207

Top open port discovered on systems with this issue 80

IPs affected by CVE-2016-6207 91,246

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2016-6207!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2016-6207

Probability of exploitation activity in the next 30 days: 1.98%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 89 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2016-6207

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:N/A:P	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H	2.8	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2016-6207

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

Assigned by: nvd@nist.gov (Primary)
CWE-190 Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.

Assigned by: nvd@nist.gov (Primary)
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2016-6207

https://security.gentoo.org/glsa/201612-09

GD: Multiple vulnerabilities (GLSA 201612-09) — Gentoo security
Third Party Advisory

CVEs referencing this url
https://bugs.php.net/bug.php?id=72558

PHP :: Sec Bug #72558 :: Integer overflow error within _gdContributionsAlloc()
Issue Tracking;Vendor Advisory
http://www.securityfocus.com/bid/92080

PHP '_gdContributionsAlloc()' Function Integer Overflow Vulnerability
Third Party Advisory;VDB Entry
http://packetstormsecurity.com/files/138174/LibGD-2.2.2-Integer-Overflow-Denial-Of-Service.html

LibGD 2.2.2 Integer Overflow / Denial Of Service ≈ Packet Storm
Third Party Advisory;VDB Entry
http://www.debian.org/security/2016/dsa-3630

Debian -- Security Information -- DSA-3630-1 libgd2
Third Party Advisory
http://www.securitytracker.com/id/1036535

libGD Integer Overflow in _gdContributionsAlloc() Lets Remote Users Cause the Target Application to Crash - SecurityTracker
Patch;Third Party Advisory;VDB Entry
http://lists.opensuse.org/opensuse-updates/2016-08/msg00086.html

openSUSE-SU-2016:2117-1: moderate: Security update for gd
Mailing List;Third Party Advisory

CVEs referencing this url
https://libgd.github.io/release-2.2.3.html

LibGD 2.2.3 release
Vendor Advisory

CVEs referencing this url
http://www.securityfocus.com/archive/1/539100/100/0/threaded

SecurityFocus
Third Party Advisory;VDB Entry
http://www.ubuntu.com/usn/USN-3060-1

USN-3060-1: GD library vulnerabilities | Ubuntu security notices
Mailing List;Third Party Advisory

CVEs referencing this url
http://rhn.redhat.com/errata/RHSA-2016-2750.html

RHSA-2016:2750 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-updates/2016-09/msg00078.html

openSUSE-SU-2016:2363-1: moderate: Security update for gd
Mailing List;Third Party Advisory

CVEs referencing this url
https://secunia.com/secunia_research/2016-9/

Secunia Research Advisories | Flexera
Third Party Advisory;VDB Entry

Products affected by CVE-2016-6207