Integer underflow in the _gdContributionsAlloc function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via vectors related to decrementing the u variable.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2519 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

    The following packages have been upgraded to a later upstream version: rh-php71-php (7.1.30). (BZ#1631672)

    Security Fix(es):

    * gd: Unsigned integer underflow _gdContributionsAlloc() (CVE-2016-10166)

    * php: Out of bounds access in php_pcre.c:php_pcre_replace_impl() (CVE-2017-9118)

    * php: Integer overflow in mysqli_api.c:mysqli_real_escape_string() (CVE-2017-9120)

    * php: Heap use after free in ext/standard/var_unserializer.re (CVE-2017-12932)

    * php: Reflected XSS in .phar 404 page (CVE-2018-5712)

    * php: Stack-based buffer under-read in php_stream_url_wrap_http_ex() in http_fopen_wrapper.c when parsing     HTTP response (CVE-2018-7584)

    * php: Infinite loop in ext/iconv/iconv.c when using stream filter with convert.incov on invalid sequence     leads to denial-of-service (CVE-2018-10546)

    * php: Reflected XSS vulnerability on PHAR 403 and 404 error pages (CVE-2018-10547)

    * php: NULL pointer dereference due to mishandling of ldap_get_dn return value allows DoS via malicious     LDAP server reply (CVE-2018-10548)

    * php: Mishandled http_header_value in an atoi() call in http_fopen_wrapper.c (CVE-2018-14884)

    * php: Cross-site scripting (XSS) flaw in Apache2 component via body of 'Transfer-Encoding: chunked'     request (CVE-2018-17082)

    * gd: Heap based buffer overflow in gdImageColorMatch() in gd_color_match.c (CVE-2019-6977)

    * php: Invalid memory access in function xmlrpc_decode() (CVE-2019-9020)

    * php: File rename across filesystems may allow unwanted access during processing (CVE-2019-9637)

    * php: Uninitialized read in exif_process_IFD_in_MAKERNOTE (CVE-2019-9638)

    * php: Uninitialized read in exif_process_IFD_in_MAKERNOTE (CVE-2019-9639)

    * php: Invalid read in exif_process_SOFn() (CVE-2019-9640)

    * php: Out-of-bounds read due to integer overflow in iconv_mime_decode_headers() (CVE-2019-11039)

    * php: Buffer over-read in exif_read_data() (CVE-2019-11040)

    * php: Out-of-bound read in timelib_meridian() (CVE-2017-16642)

    * gd: Infinite loop in gdImageCreateFromGifCtx() in gd_gif_in.c (CVE-2018-5711)

    * php: Dumpable FPM child processes allow bypassing opcache access controls (CVE-2018-10545)

    * php: Out-of-bounds read in ext/exif/exif.c:exif_read_data() when reading crafted JPEG data     (CVE-2018-10549)

    * php: exif: Buffer over-read in exif_process_IFD_in_MAKERNOTE() (CVE-2018-14851)

    * php: Buffer over-read in PHAR reading functions (CVE-2018-20783)

    * php: Heap-based buffer over-read in PHAR reading functions (CVE-2019-9021)

    * php: memcpy with negative length via crafted DNS response (CVE-2019-9022)

    * php: Heap-based buffer over-read in mbstring regular expression functions (CVE-2019-9023)

    * php: Out-of-bounds read in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c (CVE-2019-9024)

    * php: Heap buffer overflow in function exif_process_IFD_TAG() (CVE-2019-11034)

    * php: Heap buffer overflow in function exif_iif_add_value() (CVE-2019-11035)

    * php: Buffer over-read in exif_process_IFD_TAG() leading to information disclosure (CVE-2019-11036)

    * gd: Information disclosure in gdImageCreateFromXbm() (CVE-2019-11038)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3299 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

    The following packages have been upgraded to a later upstream version: rh-php72-php (7.2.24). (BZ#1766603)

    Security Fix(es):

    * php: underflow in env_path_info in fpm_main.c (CVE-2019-11043)

    * gd: Unsigned integer underflow _gdContributionsAlloc() (CVE-2016-10166)

    * gd: Heap based buffer overflow in gdImageColorMatch() in gd_color_match.c (CVE-2019-6977)

    * php: Invalid memory access in function xmlrpc_decode() (CVE-2019-9020)

    * php: File rename across filesystems may allow unwanted access during processing (CVE-2019-9637)

    * php: Uninitialized read in exif_process_IFD_in_MAKERNOTE (CVE-2019-9638)

    * php: Uninitialized read in exif_process_IFD_in_MAKERNOTE (CVE-2019-9639)

    * php: Invalid read in exif_process_SOFn() (CVE-2019-9640)

    * php: Out-of-bounds read due to integer overflow in iconv_mime_decode_headers() (CVE-2019-11039)

    * php: Buffer over-read in exif_read_data() (CVE-2019-11040)

    * php: Buffer over-read in PHAR reading functions (CVE-2018-20783)

    * php: Heap-based buffer over-read in PHAR reading functions (CVE-2019-9021)

    * php: memcpy with negative length via crafted DNS response (CVE-2019-9022)

    * php: Heap-based buffer over-read in mbstring regular expression functions (CVE-2019-9023)

    * php: Out-of-bounds read in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c (CVE-2019-9024)

    * php: Heap buffer overflow in function exif_process_IFD_TAG() (CVE-2019-11034)

    * php: Heap buffer overflow in function exif_iif_add_value() (CVE-2019-11035)

    * php: Buffer over-read in exif_process_IFD_TAG() leading to information disclosure (CVE-2019-11036)

    * gd: Information disclosure in gdImageCreateFromXbm() (CVE-2019-11038)

    * php: heap buffer over-read in exif_scan_thumbnail() (CVE-2019-11041)

    * php: heap buffer over-read in exif_process_user_comment() (CVE-2019-11042)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.40, 7.1.x prior to 7.1.26, 7.2.x prior to 7.2.14 or 7.3.x prior to 7.3.1. It is, therefore, affected by multiple vulnerabilities:

 - An integer underflow condition exists in _gdContributionsAlloc function in gd_interpolation.c. An unauthenticated, remote attacker can have unspecified impact via vectors related to decrementing the u variable. (CVE-2016-10166)

 - A heap-based buffer overflow condition exists in gdImageColorMatch due to improper calculation of the allocated buffer size. An attacker can exploit this, via calling imagecolormatch function with crafted image data as parameters. (CVE-2019-6977)

 - A heap-based buffer over-read exists in the xmlrpc_decode function due to improper validation of input data. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to cause a heap out-of-bounds read or read-after-free condition, which could result in a complete system compromise. (CVE-2019-9020)

 - A heap-based buffer over-read exists in the PHAR reading functions in the PHAR extension, due to improper implementation of memory operations. An unauthenticated, remote attacker can exploit this, via persuading a user to parse a specially crafted file name on the targeted system, to disclose sensitive information. (CVE-2019-9021)

 - An out-of-bounds read error exists in the dns_get_record function due to improper parsing of DNS responses. An unauthenticated, remote attacker can exploit this, via a specially crafted DNS reply, to disclose memory contents. (CVE-2019-9022)

 - Multiple heap-based buffer over-read instances exist in mbstring regular expression functions due to improper implementation of memory operations. An unauthenticated, remote attacker can exploit this by sending a specially crafted regular expression that contains multibyte sequences, to cause a condition that could allow the attacker to completely compromise the target system. (CVE-2019-9023)

 - An out-of-bounds read error exists in the xmlrpc_decode function due to improper implementation of memory operations. An unauthenticated, remote attacker can exploit this, via a hostile XMLRPC server to cause PHP to read from memory outside of allocated areas. (CVE-2019-9024)

 - An out-of-bounds read and write error exists in the mb_split function due to improper implementation of memory operations. An unauthenticated, remote attacker can exploit this by causing PHP to execute the memcpy function with a negative argument, to cause buffer over-read and over-write conditions which could allow the attacker to completely compromise the system. (CVE-2019-9025)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.40. It is, therefore, affected by multiple vulnerabilities:

  - An integer underflow condition exists in _gdContributionsAlloc   function in gd_interpolation.c. An unauthenticated, remote attacker   can have unspecified impact via vectors related to decrementing   the u variable. (CVE-2016-10166)

  - A heap-based buffer overflow condition exists in   gdImageColorMatch due to improper calculation of the allocated   buffer size. An attacker can exploit this, via calling   imagecolormatch function with crafted image data as parameters.
  (CVE-2019-6977)

  - A heap-based buffer over-read exists in the xmlrpc_decode function   due to improper validation of input data. An unauthenticated, remote   attacker can exploit this, via a specially crafted request, to cause   a heap out-of-bounds read or read-after-free condition, which could   result in a complete system compromise. (CVE-2019-9020)

  - A heap-based buffer over-read exists in the PHAR reading functions   in the PHAR extension, due to improper implementation of memory   operations. An unauthenticated, remote attacker can exploit this,   via persuading a user to parse a specially crafted file name on the   targeted system, to disclose sensitive information. (CVE-2019-9021)

  - Multiple heap-based buffer over-read instances exist in mbstring   regular expression functions due to improper implementation of   memory operations. An unauthenticated, remote attacker can exploit   this by sending a specially crafted regular expression that contains   multibyte sequences, to cause a condition that could allow the   attacker to completely compromise the target system. (CVE-2019-9023)

  - An out-of-bounds read error exists in the xmlrpc_decode function   due to improper implementation of memory operations. An   unauthenticated, remote attacker can exploit this, via a hostile   XMLRPC server to cause PHP to read from memory outside of allocated   areas. (CVE-2019-9024)

According to its banner, the version of PHP running on the remote web server is 7.1.x prior to 7.1.26. It is, therefore, affected by multiple vulnerabilities:

  - An integer underflow condition exists in _gdContributionsAlloc   function in gd_interpolation.c. An unauthenticated, remote attacker   can have unspecified impact via vectors related to decrementing   the u variable. (CVE-2016-10166)

  - A denial of service (DoS) vulnerability exists in   ext/imap/php_imap.c. An unauthenticated, remote attacker can   exploit this issue, via an empty string in the message argument   to the imap_mail function, to cause the application to stop   responding. (CVE-2018-19935)

  - A heap-based buffer overflow condition exists in gdImageColorMatch   due to improper calculation of the allocated buffer size. An   unauthenticated, remote attacker can exploit this via calling the   imagecolormatch function with crafted image data as parameters, to   cause a denial of service condition or the execution of arbitrary   code. (CVE-2019-6977)

  - A heap-based buffer over-read exists in the xmlrpc_decode function   due to improper validation of input data. An unauthenticated, remote   attacker can exploit this, via a specially crafted request, to cause   a heap out-of-bounds read or read-after-free condition, which could   result in a complete system compromise. (CVE-2019-9020)

  - A heap-based buffer over-read exists in the PHAR reading functions   in the PHAR extension, due to improper implementation of memory   operations. An unauthenticated, remote attacker can exploit this,   via persuading a user to parse a specially crafted file name on the   targeted system, to disclose sensitive information. (CVE-2019-9021)

  - An information disclosure vulnerability exists in the   dns_get_record function due to improper parsing of DNS responses. An   unauthenticated, remote attacker can exploit this, via a specially   crafted DNS reply sent from a rogue DNS server to disclose   potentially sensitive information. (CVE-2019-9022)

  - Multiple heap-based buffer over-read instances exist in mbstring   regular expression functions due to improper implementation of   memory operations. An unauthenticated, remote attacker can exploit   this by sending a specially crafted regular expression that contains   multibyte sequences, to cause a condition that could allow the   attacker to completely compromise the target system. (CVE-2019-9023)

  - An out-of-bounds read error exists in the xmlrpc_decode function   due to improper implementation of memory operations. An   unauthenticated, remote attacker can exploit this, via a hostile   XMLRPC server to cause PHP to read from memory outside of allocated   areas. (CVE-2019-9024)

According to its banner, the version of PHP running on the remote web server is 7.3.x prior to 7.3.1. It is, therefore, affected by multiple vulnerabilities:

  - An integer underflow condition exists in _gdContributionsAlloc   function in gd_interpolation.c. An unauthenticated, remote attacker   can have unspecified impact via vectors related to decrementing   the u variable.
  (CVE-2016-10166)

  - A heap-based buffer overflow condition exists in   gdImageColorMatch due to improper calculation of the allocated   buffer size. An attacker can exploit this, via calling   imagecolormatch function with crafted image data as parameters.
  (CVE-2019-6977)

  - A heap-based buffer over-read exists in the xmlrpc_decode function   due to improper validation of input data. An unauthenticated, remote   attacker can exploit this, via a specially crafted request, to cause   a heap out-of-bounds read or read-after-free condition, which could   result in a complete system compromise.
  (CVE-2019-9020)

  - A heap-based buffer over-read exists in the PHAR reading functions   in the PHAR extension, due to improper implementation of memory   operations. An unauthenticated, remote attacker can exploit this,   via persuading a user to parse a specially crafted file name on the   targeted system, to disclose sensitive information.
  (CVE-2019-9021)

  - Multiple heap-based buffer over-read instances exist in mbstring   regular expression functions due to improper implementation of   memory operations. An unauthenticated, remote attacker can exploit   this by sending a specially crafted regular expression that contains   multibyte sequences, to cause a condition that could allow the   attacker to completely compromise the target system.
  (CVE-2019-9023)

  - An out-of-bounds read error exists in the xmlrpc_decode function   due to improper implementation of memory operations. An   unauthenticated, remote attacker can exploit this, via a hostile   XMLRPC server to cause PHP to read from memory outside of allocated   areas.
  (CVE-2019-9024)

  - An out-of-bounds read and write error exists in the mb_split   function due to improper implementation of memory operations. An   unauthenticated, remote attacker can exploit this by causing PHP to   execute the memcpy function with a negative argument, to cause   buffer over-read and over-write conditions which could allow the   attacker to completely compromise the system.
  (CVE-2019-9025)

According to its banner, the version of PHP running on the remote web server is 7.2.x prior to 7.2.14. It is, therefore, affected by multiple vulnerabilities:

  - An integer underflow condition exists in _gdContributionsAlloc   function in gd_interpolation.c. An unauthenticated, remote attacker   can have unspecified impact via vectors related to decrementing   the u variable. (CVE-2016-10166)

  - A denial of service (DoS) vulnerability exists in   ext/imap/php_imap.c. An unauthenticated, remote attacker can   exploit this issue, via an empty string in the message argument   to the imap_mail function, to cause the application to stop   responding. (CVE-2018-19935)

  - A heap-based buffer overflow exists in gdImageColorMatch in   gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5.
  An unauthenticated, remote attacker can exploit this via the   triggering of imagecolormatch calls with crafted image data, to   cause a denial of service condition or the execution of arbitrary   code. (CVE-2019-6977)

  - A heap-based buffer over-read exists in the xmlrpc_decode function   due to improper validation of input data. An unauthenticated, remote   attacker can exploit this, via a specially crafted request, to cause   a heap out-of-bounds read or read-after-free condition, which could   result in a complete system compromise. (CVE-2019-9020)

  - A heap-based buffer over-read exists in the PHAR reading functions   in the PHAR extension, due to improper implementation of memory   operations. An unauthenticated, remote attacker can exploit this,   via persuading a user to parse a specially crafted file name on the   targeted system, to disclose sensitive information. (CVE-2019-9021)

  - An information disclosure vulnerability exists in the   dns_get_record function due to improper parsing of DNS responses. An   unauthenticated, remote attacker can exploit this, via a specially   crafted DNS reply sent from a rogue DNS server to disclose   potentially sensitive information. (CVE-2019-9022)

  - Multiple heap-based buffer over-read instances exist in mbstring   regular expression functions due to improper implementation of   memory operations. An unauthenticated, remote attacker can exploit   this by sending a specially crafted regular expression that contains   multibyte sequences, to cause a condition that could allow the   attacker to completely compromise the target system. (CVE-2019-9023)

  - An out-of-bounds read error exists in the xmlrpc_decode function   due to improper implementation of memory operations. An   unauthenticated, remote attacker can exploit this, via a hostile   XMLRPC server to cause PHP to read from memory outside of allocated   areas. (CVE-2019-9024)

This update for php5 fixes the following issues :

  - CVE-2016-7478: When unserializing untrusted input data,     PHP could end up in an infinite loop, causing denial of     service (bsc#1019550)

  - CVE-2016-10158: The exif_convert_any_to_int function in     ext/exif/exif.c in PHP allowed remote attackers to cause     a denial of service (application crash) via crafted EXIF     data that triggers an attempt to divide the minimum     representable negative integer by -1. (bsc#1022219)

  - CVE-2016-10159: Integer overflow in the     phar_parse_pharfile function in ext/phar/phar.c in PHP     allowed remote attackers to cause a denial of service     (memory consumption or application crash) via a     truncated manifest entry in a PHAR archive.
    (bsc#1022255)

  - CVE-2016-10160: Off-by-one error in the     phar_parse_pharfile function in ext/phar/phar.c in PHP     allowed remote attackers to cause a denial of service     (memory corruption) or possibly execute arbitrary code     via a crafted PHAR archive with an alias mismatch.
    (bsc#1022257)

  - CVE-2016-10161: The object_common1 function in     ext/standard/var_unserializer.c in PHP allowed remote     attackers to cause a denial of service (buffer over-read     and application crash) via crafted serialized data that     is mishandled in a finish_nested_data call.
    (bsc#1022260)

  - CVE-2016-10166: A potential unsigned underflow in gd     interpolation functions could lead to memory corruption     in the PHP gd module (bsc#1022263)

  - CVE-2016-10167: A denial of service problem in     gdImageCreateFromGd2Ctx() could lead to php out of     memory even on small files. (bsc#1022264)

  - CVE-2016-10168: A signed integer overflow in the gd     module could lead to memory corruption (bsc#1022265)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php7 fixes the following security issues :

  - CVE-2016-7480: The SplObjectStorage unserialize     implementation in ext/spl/spl_observer.c in PHP did not     verify that a key is an object, which allowed remote     attackers to execute arbitrary code or cause a denial of     service (uninitialized memory access) via crafted     serialized data. (bsc#1019568)

  - CVE-2017-5340: Zend/zend_hash.c in PHP mishandled     certain cases that require large array allocations,     which allowed remote attackers to execute arbitrary code     or cause a denial of service (integer overflow,     uninitialized memory access, and use of arbitrary     destructor function pointers) via crafted serialized     data. (bsc#1019570)

  - CVE-2016-7479: In all versions of PHP 7, during the     unserialization process, resizing the 'properties' hash     table of a serialized object may have lead to     use-after-free. A remote attacker may exploit this bug     to gain arbitrary code execution. (bsc#1019547)

  - CVE-2016-7478: Zend/zend_exceptions.c in PHP allowed     remote attackers to cause a denial of service (infinite     loop) via a crafted Exception object in serialized data,     a related issue to CVE-2015-8876. (bsc#1019550)

  - CVE-2016-10159: Integer overflow in the     phar_parse_pharfile function in ext/phar/phar.c in PHP     allowed remote attackers to cause a denial of service     (memory consumption or application crash) via a     truncated manifest entry in a PHAR archive.
    (bsc#1022255)

  - CVE-2016-10160: Off-by-one error in the     phar_parse_pharfile function in ext/phar/phar.c in PHP     allowed remote attackers to cause a denial of service     (memory corruption) or possibly execute arbitrary code     via a crafted PHAR archive with an alias mismatch.
    (bsc#1022257)

  - CVE-2016-10161: The object_common1 function in     ext/standard/var_unserializer.c in PHP allowed remote     attackers to cause a denial of service (buffer over-read     and application crash) via crafted serialized data that     is mishandled in a finish_nested_data call.
    (bsc#1022260)

  - CVE-2016-10162: The php_wddx_pop_element function in     ext/wddx/wddx.c in PHP 7 allowed remote attackers to     cause a denial of service (NULL pointer dereference and     application crash) via an inapplicable class name in a     wddxPacket XML document, leading to mishandling in a     wddx_deserialize call. (bsc#1022262)

  - CVE-2016-10166: A potential unsigned underflow in gd     interpolation functions could lead to memory corruption     in the PHP gd module (bsc#1022263)

  - CVE-2016-10167: A denial of service problem in     gdImageCreateFromGd2Ctx() could lead to php out of     memory even on small files. (bsc#1022264)

  - CVE-2016-10168: A signed integer overflow in the gd     module could lead to memory corruption (bsc#1022265)

  - CVE-2016-9138: PHP mishandled property modification     during __wakeup processing, which allows remote     attackers to cause a denial of service or possibly have     unspecified other impact via crafted serialized data, as     demonstrated by Exception::__toString with     DateInterval::__wakeup. (bsc#1008026)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New gd packages are available for Slackware 14.2 and -current to fix security issues.

- various security relevant flaws

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php7 fixes the following security issues :

  - CVE-2016-7480: The SplObjectStorage unserialize     implementation in ext/spl/spl_observer.c in PHP did not     verify that a key is an object, which allowed remote     attackers to execute arbitrary code or cause a denial of     service (uninitialized memory access) via crafted     serialized data. (bsc#1019568)

  - CVE-2017-5340: Zend/zend_hash.c in PHP mishandled     certain cases that require large array allocations,     which allowed remote attackers to execute arbitrary code     or cause a denial of service (integer overflow,     uninitialized memory access, and use of arbitrary     destructor function pointers) via crafted serialized     data. (bsc#1019570)

  - CVE-2016-7479: In all versions of PHP 7, during the     unserialization process, resizing the 'properties' hash     table of a serialized object may have lead to     use-after-free. A remote attacker may exploit this bug     to gain arbitrary code execution. (bsc#1019547)

  - CVE-2016-7478: Zend/zend_exceptions.c in PHP allowed     remote attackers to cause a denial of service (infinite     loop) via a crafted Exception object in serialized data,     a related issue to CVE-2015-8876. (bsc#1019550)

  - CVE-2016-10159: Integer overflow in the     phar_parse_pharfile function in ext/phar/phar.c in PHP     allowed remote attackers to cause a denial of service     (memory consumption or application crash) via a     truncated manifest entry in a PHAR archive.
    (bsc#1022255)

  - CVE-2016-10160: Off-by-one error in the     phar_parse_pharfile function in ext/phar/phar.c in PHP     allowed remote attackers to cause a denial of service     (memory corruption) or possibly execute arbitrary code     via a crafted PHAR archive with an alias mismatch.
    (bsc#1022257)

  - CVE-2016-10161: The object_common1 function in     ext/standard/var_unserializer.c in PHP allowed remote     attackers to cause a denial of service (buffer over-read     and application crash) via crafted serialized data that     is mishandled in a finish_nested_data call.
    (bsc#1022260)

  - CVE-2016-10162: The php_wddx_pop_element function in     ext/wddx/wddx.c in PHP 7 allowed remote attackers to     cause a denial of service (NULL pointer dereference and     application crash) via an inapplicable class name in a     wddxPacket XML document, leading to mishandling in a     wddx_deserialize call. (bsc#1022262)

  - CVE-2016-10166: A potential unsigned underflow in gd     interpolation functions could lead to memory corruption     in the PHP gd module (bsc#1022263)

  - CVE-2016-10167: A denial of service problem in     gdImageCreateFromGd2Ctx() could lead to php out of     memory even on small files. (bsc#1022264)

  - CVE-2016-10168: A signed integer overflow in the gd     module could lead to memory corruption (bsc#1022265)

  - CVE-2016-9138: PHP mishandled property modification     during __wakeup processing, which allows remote     attackers to cause a denial of service or possibly have     unspecified other impact via crafted serialized data, as     demonstrated by Exception::__toString with     DateInterval::__wakeup. (bsc#1008026)

This update was imported from the SUSE:SLE-12:Update update project.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3213-1 advisory.

    Stefan Esser discovered that the GD library incorrectly handled memory when processing certain images. If     a user or automated system were tricked into processing a specially crafted image, an attacker could cause     a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu     16.04 LTS and Ubuntu 16.10. (CVE-2016-10166)

    It was discovered that the GD library incorrectly handled certain malformed images. If a user or automated     system were tricked into processing a specially crafted image, an attacker could cause a denial of     service. (CVE-2016-10167)

    It was discovered that the GD library incorrectly handled certain malformed images. If a user or automated     system were tricked into processing a specially crafted image, an attacker could cause a denial of     service, or possibly execute arbitrary code. (CVE-2016-10168)

    Ibrahim El-Sayed discovered that the GD library incorrectly handled certain malformed TGA images. If a     user or automated system were tricked into processing a specially crafted TGA image, an attacker could     cause a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10.
    (CVE-2016-6906)

    Ibrahim El-Sayed discovered that the GD library incorrectly handled certain malformed WebP images. If a     user or automated system were tricked into processing a specially crafted WebP image, an attacker could     cause a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS,     Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-6912)

    It was discovered that the GD library incorrectly handled creating oversized images. If a user or     automated system were tricked into creating a specially crafted image, an attacker could cause a denial of     service. (CVE-2016-9317)

    It was discovered that the GD library incorrectly handled filling certain images. If a user or automated     system were tricked into filling an image, an attacker could cause a denial of service. (CVE-2016-9933)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for php53 fixes the following security issues :

  - CVE-2016-7478: When unserializing untrusted input data,     PHP could end up in an infinite loop, causing denial of     service (bsc#1019550)

  - CVE-2016-10158: The exif_convert_any_to_int function in     ext/exif/exif.c in PHP allowed remote attackers to cause     a denial of service (application crash) via crafted EXIF     data that triggers an attempt to divide the minimum     representable negative integer by -1. (bsc#1022219)

  - CVE-2016-10159: Integer overflow in the     phar_parse_pharfile function in ext/phar/phar.c in PHP     allowed remote attackers to cause a denial of service     (memory consumption or application crash) via a     truncated manifest entry in a PHAR archive.
    (bsc#1022255)

  - CVE-2016-10160: Off-by-one error in the     phar_parse_pharfile function in ext/phar/phar.c in PHP     allowed remote attackers to cause a denial of service     (memory corruption) or possibly execute arbitrary code     via a crafted PHAR archive with an alias mismatch.
    (bsc#1022257)

  - CVE-2016-10161: The object_common1 function in     ext/standard/var_unserializer.c in PHP allowed remote     attackers to cause a denial of service (buffer over-read     and application crash) via crafted serialized data that     is mishandled in a finish_nested_data call.
    (bsc#1022260)

  - CVE-2016-10166: A potential unsigned underflow in gd     interpolation functions could lead to memory corruption     in the PHP gd module (bsc#1022263)

  - CVE-2016-10167: A denial of service problem in     gdImageCreateFromGd2Ctx() could lead to php out of     memory even on small files. (bsc#1022264)

  - CVE-2016-10168: A signed integer overflow in the gd     module could lead to memory corruption (bsc#1022265)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for gd fixes the following security issues :

  - CVE-2016-6906: An out-of-bounds read in TGA     decompression was fixed which could have lead to     crashes. (bsc#1022553)

  - CVE-2016-6912: Double free vulnerability in the     gdImageWebPtr function in the GD Graphics Library (aka     libgd) allowed remote attackers to have unspecified     impact via large width and height values. (bsc#1022284)

  - CVE-2016-9317: The gdImageCreate function in the GD     Graphics Library (aka libgd) allowed remote attackers to     cause a denial of service (system hang) via an oversized     image. (bsc#1022283)

  - CVE-2016-10166: A potential unsigned underflow in gd     interpolation functions could lead to memory corruption     in the GD Graphics Library (aka libgd) (bsc#1022263)

  - CVE-2016-10167: A denial of service problem in     gdImageCreateFromGd2Ctx() could lead to libgd running     out of memory even on small files. (bsc#1022264)

  - CVE-2016-10168: A signed integer overflow in the GD     Graphics Library (aka libgd) could lead to memory     corruption (bsc#1022265)

This update was imported from the SUSE:SLE-12:Update update project.

This update for gd fixes the following security issues :

  - CVE-2016-6906: An out-of-bounds read in TGA     decompression was fixed which could have lead to     crashes. (bsc#1022553)

  - CVE-2016-6912: Double free vulnerability in the     gdImageWebPtr function in the GD Graphics Library (aka     libgd) allowed remote attackers to have unspecified     impact via large width and height values. (bsc#1022284)

  - CVE-2016-9317: The gdImageCreate function in the GD     Graphics Library (aka libgd) allowed remote attackers to     cause a denial of service (system hang) via an oversized     image. (bsc#1022283)

  - CVE-2016-10166: A potential unsigned underflow in gd     interpolation functions could lead to memory corruption     in the GD Graphics Library (aka libgd) (bsc#1022263)

  - CVE-2016-10167: A denial of service problem in     gdImageCreateFromGd2Ctx() could lead to libgd running     out of memory even on small files. (bsc#1022264)

  - CVE-2016-10168: A signed integer overflow in the GD     Graphics Library (aka libgd) could lead to memory     corruption (bsc#1022265)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities have been discovered in libgd2, a library for programmatic graphics creation and manipulation, which may result in denial of service or potentially the execution of arbitrary code if a malformed file is processed.

ID	Name	Product	Family	Severity
194152	RHEL 7 : rh-php71-php (RHSA-2019:2519)	Nessus	Red Hat Local Security Checks	critical
193829	RHEL 7 : rh-php72-php (RHSA-2019:3299)	Nessus	Red Hat Local Security Checks	critical
98245	PHP 5.6.x < 5.6.40 Multiple vulnerabilities	Web App Scanning	Component Vulnerability	critical
98244	PHP 7.1.x < 7.1.26 Multiple vulnerabilities	Web App Scanning	Component Vulnerability	critical
98243	PHP 7.2.x < 7.2.14 Multiple vulnerabilities	Web App Scanning	Component Vulnerability	critical
98242	PHP 7.3.x < 7.3.1 Multiple vulnerabilities	Web App Scanning	Component Vulnerability	critical
121602	PHP 5.6.x < 5.6.40 Multiple vulnerabilities.	Nessus	CGI abuses	critical
121510	PHP 7.1.x < 7.1.26 Multiple vulnerabilities.	Nessus	CGI abuses	critical
121475	PHP 7.3.x < 7.3.1 Multiple vulnerabilities.	Nessus	CGI abuses	critical
121353	PHP 7.2.x < 7.2.14 Multiple vulnerabilities.	Nessus	CGI abuses	critical
119994	SUSE SLES12 Security Update : php5 (SUSE-SU-2017:0556-1)	Nessus	SuSE Local Security Checks	critical
119993	SUSE SLES12 Security Update : php7 (SUSE-SU-2017:0534-1)	Nessus	SuSE Local Security Checks	critical
101790	Slackware 14.2 / current : gd (SSA:2017-199-02)	Nessus	Slackware Local Security Checks	critical
97706	Fedora 24 : libwmf (2017-9a5b89363f)	Nessus	Fedora Local Security Checks	critical
97563	openSUSE Security Update : php7 (openSUSE-2017-304)	Nessus	SuSE Local Security Checks	critical
97468	Ubuntu 14.04 LTS / 16.04 LTS : GD library vulnerabilities (USN-3213-1)	Nessus	Ubuntu Local Security Checks	critical
97431	SUSE SLES11 Security Update : php53 (SUSE-SU-2017:0568-1)	Nessus	SuSE Local Security Checks	critical
97369	openSUSE Security Update : gd (openSUSE-2017-289)	Nessus	SuSE Local Security Checks	critical
97203	SUSE SLED12 / SLES12 Security Update : gd (SUSE-SU-2017:0468-1)	Nessus	SuSE Local Security Checks	critical
97181	Fedora 25 : libwmf (2017-f787c35494)	Nessus	Fedora Local Security Checks	critical
96912	Debian DSA-3777-1 : libgd2 - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2016-10166

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical