Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2016-7568: libgd used by PHP can crash the server
CVE-2016-7568 · published 10 years ago
Summary
The GD graphics library (version up to 2.2.3) that PHP 7.0.11 relies on can be tricked by a specially‑crafted webp image to overflow a number and overwrite memory. This may cause the web application to stop working or crash, potentially letting an attacker disrupt service. Update the GD library to a newer version or apply the vendor’s patch to stop the problem.
What to do
- Update debian libgd2 to version 2.2.3-87-gd0fec80-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | libgd2 |
< 2.2.3-87-gd0fec80-1 Fix: upgrade to 2.2.3-87-gd0fec80-1
|
| Debian:13 | debian | libgd2 |
< 2.2.3-87-gd0fec80-1 Fix: upgrade to 2.2.3-87-gd0fec80-1
|
| Debian:14 | debian | libgd2 |
< 2.2.3-87-gd0fec80-1 Fix: upgrade to 2.2.3-87-gd0fec80-1
|
| – | libgd | libgd |
<= 2.2.3 cpe:2.3:a:libgd:libgd:*:*:*:*:*:*:*:* |
| – | php | php |
>= 5.6.0, <= 5.6.26 >= 7.0.0, <= 7.0.11 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* |
| – | debian | debian_linux |
8.0 cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* |
Original advisory text
Integer overflow in the gdImageWebpCtx function in gd_webp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP through 7.0.11, allows remote attackers to cause a denial of servic...
Integer overflow in the gdImageWebpCtx function in gd_webp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP through 7.0.11, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted imagewebp and imagedestroy calls.
References
- https://security-tracker.debian.org/tracker/CVE-2016-7568 Vendor Advisory
- http://www.debian.org/security/2016/dsa-3693 Third Party Advisory
- http://www.securityfocus.com/bid/93184 Third Party Advisory VDB Entry
- https://bugs.php.net/bug.php?id=73003 Issue Tracking Vendor Advisory
- https://github.com/libgd/libgd/commit/40bec0f38f50e8510f5bb71a82f516d46facde03 Issue Tracking Patch Third Party Advisory
- https://github.com/libgd/libgd/issues/308 Issue Tracking Patch Third Party Advisory
- https://github.com/php/php-src/commit/c18263e0e0769faee96a5d0ee04b750c442783c6 Issue Tracking Patch Third Party Advisory
- https://security.gentoo.org/glsa/201612-09 Third Party Advisory
Severity
9.8
Critical
Type
CWE-190Integer Overflow
Timeline
Published28 Sep 2016
Updated25 Oct 2026
First seen22 Sep 2026
Track software like this
Free during beta