This update for gd fixes the following issues :

  - CVE-2016-6214: Buffer over-read issue when parsing     crafted TGA file [bsc#991436]

  - CVE-2016-6132: read out-of-bands was found in the     parsing of TGA files using libgd [bsc#987577]

  - CVE-2016-6128: Invalid color index not properly handled     [bsc#991710]

  - CVE-2016-6207: Integer overflow error within
    _gdContributionsAlloc() [bsc#991622]

  - CVE-2016-6161: global out of bounds read when encoding     gif from malformed input withgd2togif [bsc#988032]

This update for php5 fixes the following security issues :

  - CVE-2016-6128: Invalid color index not properly handled     [bsc#987580]

  - CVE-2016-6161: global out of bounds read when encoding     gif from malformed input withgd2togif [bsc#988032]

  - CVE-2016-6292: NULL pointer dereference in     exif_process_user_comment [bsc#991422]

  - CVE-2016-6295: Use after free in SNMP with GC and     unserialize() [bsc#991424]

  - CVE-2016-6297: Stack-based buffer overflow vulnerability     in php_stream_zip_opener [bsc#991426]

  - CVE-2016-6291: Out-of-bounds access in     exif_process_IFD_in_MAKERNOTE [bsc#991427]

  - CVE-2016-6289: Integer overflow leads to buffer overflow     in virtual_file_ex [bsc#991428]

  - CVE-2016-6290: Use after free in unserialize() with     Unexpected Session Deserialization [bsc#991429]

  - CVE-2016-5399: Improper error handling in bzread()     [bsc#991430]

  - CVE-2016-6296: Heap buffer overflow vulnerability in     simplestring_addn in simplestring.c [bsc#991437]

  - CVE-2016-6207: Integer overflow error within
    _gdContributionsAlloc() [bsc#991434]

  - CVE-2014-3587: Integer overflow in the     cdf_read_property_info affecting SLES11 SP3 [bsc#987530]

  - CVE-2016-6288: Buffer over-read in php_url_parse_ex     [bsc#991433]

  - CVE-2016-7124: Create an Unexpected Object and Don't     Invoke __wakeup() in Deserialization

  - CVE-2016-7125: PHP Session Data Injection Vulnerability

  - CVE-2016-7126: select_colors write out-of-bounds

  - CVE-2016-7127: imagegammacorrect allowed arbitrary write     access

  - CVE-2016-7128: Memory Leakage In     exif_process_IFD_in_TIFF

  - CVE-2016-7129: wddx_deserialize allowed illegal memory     access

  - CVE-2016-7130: wddx_deserialize null dereference

  - CVE-2016-7131: wddx_deserialize null dereference with     invalid xml

  - CVE-2016-7132: wddx_deserialize null dereference in     php_wddx_pop_element

  - CVE-2016-7134: Heap overflow in the function curl_escape

This update was imported from the SUSE:SLE-12:Update update project.

Several vulnerabilities were discovered in libgd2, a library for programmatic graphics creation and manipulation. A remote attacker can take advantage of these flaws to cause a denial-of-service against an application using the libgd2 library (application crash), or potentially to execute arbitrary code with the privileges of the user running the application.

This update for gd fixes the following issues :

  - CVE-2016-6214: Buffer over-read issue when parsing     crafted TGA file [bsc#991436]

  - CVE-2016-6132: read out-of-bands was found in the     parsing of TGA files using libgd [bsc#987577]

  - CVE-2016-6128: Invalid color index not properly handled     [bsc#991710]

  - CVE-2016-6207: Integer overflow error within
    _gdContributionsAlloc() [bsc#991622]

  - CVE-2016-6161: global out of bounds read when encoding     gif from malformed input withgd2togif [bsc#988032]

  - CVE-2016-5116: avoid stack overflow (read) with large     names [bsc#982176]

  - CVE-2016-6905: Out-of-bounds read in function     read_image_tga in gd_tga.c [bsc#995034]

This update was imported from the SUSE:SLE-12:Update update project.

According to the versions of the gd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The output function in gd_gif_out.c in the GD Graphics     Library (aka libgd) allows remote attackers to cause a     denial of service (out-of-bounds read) via a crafted     image.(CVE-2016-6161)

  - The dynamicGetbuf function in the GD Graphics Library     (aka libgd) before 2.2.4 allows remote attackers to     cause a denial of service (out-of-bounds read) via a     crafted TIFF image.(CVE-2016-6911)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
93063	openSUSE Security Update : gd (openSUSE-2016-1003)	Nessus	SuSE Local Security Checks	2016/8/22	2026/1/28	high
93856	openSUSE Security Update : php5 (openSUSE-2016-1156)	Nessus	SuSE Local Security Checks	2016/10/5	2026/1/22	critical
92327	Debian DSA-3619-1 : libgd2 - security update	Nessus	Debian Local Security Checks	2016/7/18	2026/2/2	critical
93701	openSUSE Security Update : gd (openSUSE-2016-1108)	Nessus	SuSE Local Security Checks	2016/9/26	2026/1/23	critical
131801	EulerOS 2.0 SP5 : gd (EulerOS-SA-2019-2527)	Nessus	Huawei Local Security Checks	2019/12/9	2022/5/18	medium

検出

プラグインの検索

high

critical

critical

critical

medium