gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.

This update for gd fixes the following issues :

  - CVE-2016-6214: Buffer over-read issue when parsing     crafted TGA file [bsc#991436]

  - CVE-2016-6132: read out-of-bands was found in the     parsing of TGA files using libgd [bsc#987577]

  - CVE-2016-6128: Invalid color index not properly handled     [bsc#991710]

  - CVE-2016-6207: Integer overflow error within
    _gdContributionsAlloc() [bsc#991622]

  - CVE-2016-6161: global out of bounds read when encoding     gif from malformed input withgd2togif [bsc#988032]

  - CVE-2016-5116: avoid stack overflow (read) with large     names [bsc#982176]

  - CVE-2016-6905: Out-of-bounds read in function     read_image_tga in gd_tga.c [bsc#995034]

This update was imported from the SUSE:SLE-12:Update update project.

This update for gd fixes the following issues :

  - CVE-2016-6214: Buffer over-read issue when parsing     crafted TGA file [bsc#991436]

  - CVE-2016-6132: read out-of-bands was found in the     parsing of TGA files using libgd [bsc#987577]

  - CVE-2016-6128: Invalid color index not properly handled     [bsc#991710]

  - CVE-2016-6207: Integer overflow error within
    _gdContributionsAlloc() [bsc#991622]

  - CVE-2016-6161: global out of bounds read when encoding     gif from malformed input withgd2togif [bsc#988032]

  - CVE-2016-5116: avoid stack overflow (read) with large     names [bsc#982176]

  - CVE-2016-6905: Out-of-bounds read in function     read_image_tga in gd_tga.c [bsc#995034]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for gd fixes the following issues :

  - CVE-2016-6214: Buffer over-read issue when parsing     crafted TGA file [bsc#991436]

  - CVE-2016-6132: read out-of-bands was found in the     parsing of TGA files using libgd [bsc#987577]

  - CVE-2016-6128: Invalid color index not properly handled     [bsc#991710]

  - CVE-2016-6207: Integer overflow error within
    _gdContributionsAlloc() [bsc#991622]

  - CVE-2016-6161: global out of bounds read when encoding     gif from malformed input withgd2togif [bsc#988032]

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3060-1 advisory.

    It was discovered that the GD library incorrectly handled certain malformed TGA images. If a user or     automated system were tricked into processing a specially crafted TGA image, an attacker could cause a     denial of service. (CVE-2016-6132, CVE-2016-6214)

    It was discovered that the GD library incorrectly handled memory when using gdImageScale(). A remote     attacker could possibly use this issue to cause a denial of service or possibly execute arbitrary code.
    (CVE-2016-6207)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

**LibGD 2.2.3 release**

Security related fixes: This flaw is caused by loading data from external sources (file, custom ctx, etc) and are hard to validate before calling libgd APIs :

  - fix php bug php#72339, Integer Overflow in _gd2GetHeader     (CVE-2016-5766)

  - bug #248, fix Out-Of-Bounds Read in read_image_tga

Using application provided parameters, in these cases invalid data causes the issues :

  - Integer overflow error within _gdContributionsAlloc()     (CVE-2016-6207)

  - fix php bug php#72494, invalid color index not handled,     can lead to crash

  - improve color check for CropThreshold

Important update :

  - gdImageCopyResampled has been improved. Better handling     of images with alpha channel, also brings libgd in sync     with php's bundled gd.

This is a recommended update.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in libgd2, a library for programmatic graphics creation and manipulation. A remote attacker can take advantage of these flaws to cause a denial-of-service against an application using the libgd2 library (application crash), or potentially to execute arbitrary code with the privileges of the user running the application.

ID	Name	Product	Family	Severity
93701	openSUSE Security Update : gd (openSUSE-2016-1108)	Nessus	SuSE Local Security Checks	critical
93506	SUSE SLED12 / SLES12 Security Update : gd (SUSE-SU-2016:2303-1)	Nessus	SuSE Local Security Checks	critical
93063	openSUSE Security Update : gd (openSUSE-2016-1003)	Nessus	SuSE Local Security Checks	high
92869	Ubuntu 14.04 LTS / 16.04 LTS : GD library vulnerabilities (USN-3060-1)	Nessus	Ubuntu Local Security Checks	medium
92532	Fedora 24 : gd (2016-615f3bf06e)	Nessus	Fedora Local Security Checks	high
92327	Debian DSA-3619-1 : libgd2 - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2016-6214

medium

Tenable Plugins

critical

critical

high

medium

high

critical