CVE-2016-7568
Last modified
CVE-2016-7568 is a vulnerability of currently unknown severity. Integer overflow in the gdImageWebpCtx function in gd_webp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP through 7.0.11, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted imagewebp and imagedestroy calls.. EPSS estimates a 5.10% chance of exploitation in the next 30 days.
Description
Integer overflow in the gdImageWebpCtx function in gd_webp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP through 7.0.11, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted imagewebp and imagedestroy calls.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Libgd | Libgd | <= 2.2.3 |
| Php | Php | >= 5.6.0, <= 5.6.26 |
| Php | Php | >= 7.0.0, <= 7.0.11 |
| Debian | Debian Linux | 8.0 |
References
- http://www.debian.org/security/2016/dsa-3693Third Party Advisory
- http://www.securityfocus.com/bid/93184Third Party Advisory, VDB Entry
- https://bugs.php.net/bug.php?id=73003Issue Tracking, Vendor Advisory
- https://github.com/libgd/libgd/commit/40bec0f38f50e8510f5bb71a82f516d46facde03Issue Tracking, Patch, Third Party Advisory
- https://github.com/libgd/libgd/issues/308Issue Tracking, Patch, Third Party Advisory
- https://github.com/php/php-src/commit/c18263e0e0769faee96a5d0ee04b750c442783c6Issue Tracking, Patch, Third Party Advisory
- https://security.gentoo.org/glsa/201612-09Third Party Advisory
- http://www.debian.org/security/2016/dsa-3693Third Party Advisory
- http://www.securityfocus.com/bid/93184Third Party Advisory, VDB Entry
- https://bugs.php.net/bug.php?id=73003Issue Tracking, Vendor Advisory
- https://github.com/libgd/libgd/commit/40bec0f38f50e8510f5bb71a82f516d46facde03Issue Tracking, Patch, Third Party Advisory
- https://github.com/libgd/libgd/issues/308Issue Tracking, Patch, Third Party Advisory
- https://github.com/php/php-src/commit/c18263e0e0769faee96a5d0ee04b750c442783c6Issue Tracking, Patch, Third Party Advisory
- https://security.gentoo.org/glsa/201612-09Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2016-7568?
How severe is CVE-2016-7568?
How do I fix CVE-2016-7568?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2016
- CVE-2016-7561Fortinet FortiWLC 6.1-2-29 and earlier, 7.0-9-1, 7.0-10-0, 8…
- CVE-2016-7562The ff_draw_pc_font function in libavcodec/cga_data.c in FFm…
- CVE-2016-7563The chartorune function in Artifex Software MuJS allows atta…
- CVE-2016-7564Heap-based buffer overflow in the Fp_toString function in js…
- CVE-2016-7565install/index.php in Exponent CMS 2.3.9 allows remote attack…
- CVE-2016-7567Buffer overflow in the SLPFoldWhiteSpace function in common/…9.8
- CVE-2016-7569Directory traversal vulnerability in docker2aci before 0.13.…
- CVE-2016-7570Drupal 8.x before 8.1.10 does not properly check for "Admini…
- CVE-2016-7571Cross-site scripting (XSS) vulnerability in Drupal 8.x befor…
- CVE-2016-7572The system.temporary route in Drupal 8.x before 8.1.10 does …
- CVE-2016-7575Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2016-7576In iOS before 9.3.3, a memory corruption issue existed in th…
Are you affected by CVE-2016-7568?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST