CVE-2016-5116
Vulnerability from cvelistv5
Published
2016-08-07 10:00
Modified
2024-08-06 00:53
Severity ?
EPSS score ?
Summary
gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name.
References
▼ | URL | Tags | |
---|---|---|---|
cve@mitre.org | http://lists.opensuse.org/opensuse-updates/2016-09/msg00078.html | Third Party Advisory | |
cve@mitre.org | http://www.debian.org/security/2016/dsa-3619 | Third Party Advisory | |
cve@mitre.org | http://www.openwall.com/lists/oss-security/2016/05/29/5 | Mailing List | |
cve@mitre.org | http://www.ubuntu.com/usn/USN-3030-1 | ||
cve@mitre.org | https://github.com/libgd/libgd/commit/4dc1a2d7931017d3625f2d7cff70a17ce58b53b4 | Issue Tracking, Patch, Third Party Advisory | |
cve@mitre.org | https://github.com/libgd/libgd/issues/211 | Issue Tracking, Third Party Advisory |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-06T00:53:47.352Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "openSUSE-SU-2016:2363", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-updates/2016-09/msg00078.html" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://github.com/libgd/libgd/issues/211" }, { "name": "[oss-security] 20160529 Re: CVE Request: libgd - gdCtxPrintf memory leak", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2016/05/29/5" }, { "name": "DSA-3619", "tags": [ "vendor-advisory", "x_refsource_DEBIAN", "x_transferred" ], "url": "http://www.debian.org/security/2016/dsa-3619" }, { "name": "USN-3030-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU", "x_transferred" ], "url": "http://www.ubuntu.com/usn/USN-3030-1" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://github.com/libgd/libgd/commit/4dc1a2d7931017d3625f2d7cff70a17ce58b53b4" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "datePublic": "2016-05-29T00:00:00", "descriptions": [ { "lang": "en", "value": "gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2016-11-25T20:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre" }, "references": [ { "name": "openSUSE-SU-2016:2363", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-updates/2016-09/msg00078.html" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://github.com/libgd/libgd/issues/211" }, { "name": "[oss-security] 20160529 Re: CVE Request: libgd - gdCtxPrintf memory leak", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "http://www.openwall.com/lists/oss-security/2016/05/29/5" }, { "name": "DSA-3619", "tags": [ "vendor-advisory", "x_refsource_DEBIAN" ], "url": "http://www.debian.org/security/2016/dsa-3619" }, { "name": "USN-3030-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU" ], "url": "http://www.ubuntu.com/usn/USN-3030-1" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://github.com/libgd/libgd/commit/4dc1a2d7931017d3625f2d7cff70a17ce58b53b4" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2016-5116", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "openSUSE-SU-2016:2363", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-updates/2016-09/msg00078.html" }, { "name": "https://github.com/libgd/libgd/issues/211", "refsource": "CONFIRM", "url": "https://github.com/libgd/libgd/issues/211" }, { "name": "[oss-security] 20160529 Re: CVE Request: libgd - gdCtxPrintf memory leak", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2016/05/29/5" }, { "name": "DSA-3619", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2016/dsa-3619" }, { "name": "USN-3030-1", "refsource": "UBUNTU", "url": "http://www.ubuntu.com/usn/USN-3030-1" }, { "name": "https://github.com/libgd/libgd/commit/4dc1a2d7931017d3625f2d7cff70a17ce58b53b4", "refsource": "CONFIRM", "url": "https://github.com/libgd/libgd/commit/4dc1a2d7931017d3625f2d7cff70a17ce58b53b4" } ] } } } }, "cveMetadata": { "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2016-5116", "datePublished": "2016-08-07T10:00:00", "dateReserved": "2016-05-29T00:00:00", "dateUpdated": "2024-08-06T00:53:47.352Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2016-5116\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2016-08-07T10:59:12.257\",\"lastModified\":\"2018-10-30T16:27:32.030\",\"vulnStatus\":\"Modified\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name.\"},{\"lang\":\"es\",\"value\":\"gd_xbm.c en la GD Graphics Library (tambi\u00e9n conocido como libgd) en versiones anteriores a 2.2.0, como se utiliza en ciertas configuraciones personalizadas PHP 5.5.x, permite a atacantes dependientes del contexto obtener informaci\u00f3n sensible del proceso de memoria o provocar una denegaci\u00f3n de servicio (lectura debajo de desbordamiento de b\u00fafer basado en la pila y ca\u00edda de aplicaci\u00f3n) a trav\u00e9s de un nombre largo.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:N/A:P\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\",\"baseScore\":6.4},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":4.9,\"acInsufInfo\":true,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-119\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:libgd:libgd:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2.2.1\",\"matchCriteriaId\":\"73B08A9F-CFCC-4B42-8F53-FC8C8AA44501\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9F6D9B19-E64D-4BED-9194-17460CE19E6F\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.0:alpha1:*:*:*:*:*:*\",\"matchCriteriaId\":\"3D25E591-448C-4E3B-8557-6E48F7571796\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.0:alpha2:*:*:*:*:*:*\",\"matchCriteriaId\":\"6DA18F3F-B4B5-40C3-BF19-67C1F0C1787D\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.0:alpha3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3AF783C9-26E7-4E02-BD41-77B9783667E3\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.0:alpha4:*:*:*:*:*:*\",\"matchCriteriaId\":\"EF49701D-ECE4-4CEB-BDAB-24C09C8AD4B4\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.0:alpha5:*:*:*:*:*:*\",\"matchCriteriaId\":\"7AEDF6F7-001D-4A35-A26F-417991AD377F\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.0:alpha6:*:*:*:*:*:*\",\"matchCriteriaId\":\"4031DB99-B4B4-41EC-B3C1-543D92C575A9\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.0:beta1:*:*:*:*:*:*\",\"matchCriteriaId\":\"D5450EA7-A398-49D2-AA8E-7C95B074BAB1\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.0:beta2:*:*:*:*:*:*\",\"matchCriteriaId\":\"04FE0E4E-BC94-4DC9-BE9B-DC57B952B2FB\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.0:beta3:*:*:*:*:*:*\",\"matchCriteriaId\":\"BB8E09D8-9CBE-4279-88B7-24A214A5A537\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.0:beta4:*:*:*:*:*:*\",\"matchCriteriaId\":\"2D41ECCE-887D-49A2-9BB3-B559495AC55B\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"79B418BC-27F4-4443-A0F7-FF4ADA568C1B\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"8EEBDF62-BA1B-4438-9AEA-8B56AA5713E8\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F644EA6C-50C6-4A1C-A4AC-287AA9477B46\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DD47F30-74F5-48E8-8657-C2373FE2BD22\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0C09527B-6B47-41F8-BDE6-01C47E452286\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2E454D87-23CB-4D7F-90FE-942EE54D661F\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1031E646-F2CF-4A3E-8E6A-5D4BC950BEDA\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"130E50C1-D209-4CFF-9399-69D561340FBB\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C1F29948-9417-460B-8B04-D91AE4E8B423\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A37D00C1-4F41-4400-9CE4-8E8BAA3E4142\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"093D08B7-CC3C-4616-8697-F15B253A7D9A\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E9CD8FEE-DE7B-47CB-9985-4092BFA071D0\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A30B2D9E-F289-43C9-BFBC-1CEF284A417E\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FE41CFDF-8ECD-41C1-94A7-5AFD42C5DDEA\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6AEAC9BA-AF82-4345-839C-D339DCB962A7\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1EFE682F-52E3-48EC-A993-F522FC29712F\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.18:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AC63A449-5D92-4F5F-8186-B58FFFBA54FE\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.19:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F18236F6-2065-4A6A-93E7-FD90E650C689\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.20:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DEFBA84A-A4E4-438B-B9B5-8549809DCECC\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.21:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"146D3DC9-50F4-430B-B321-68ECE78879A7\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.22:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D5A7CA6-7653-46C5-8DF7-95584BF7A879\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.23:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C5BA8300-2F4D-4C1E-8CCE-F45E8F3547A0\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.24:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"59A42F02-F363-4C13-BE83-19F757B84455\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.25:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"423ECD5F-5611-4D9A-8BE8-E4DC1527AF58\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.26:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"44FE4648-22C5-44A6-A6DF-8B235EB7DEF5\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.27:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"23006CC4-85FB-48AF-8F3A-97BC3FD7FAF6\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.28:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D6393D02-3968-4B0F-A2DE-61442E95DB32\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.29:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0F0E1ABF-05E0-4FB9-841E-6287B9D7E4D3\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.30:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0CDB4ADD-2148-47CD-93B2-1DD65067659A\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.31:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7FE4651D-40F4-44BF-88AD-D0BFB85399D3\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.32:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9AE68A1B-B1EE-40BD-A294-69FE44746420\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.33:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D4F004EF-2D0C-4ED3-A2D7-5BCB6B32C718\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.34:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"65F170BE-283F-4C66-A123-562F8C93C097\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.35:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CD1E1C27-7D14-414D-B067-48DD48B671A7\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.37:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C4FF1053-A485-47F3-B60E-F5A68AE46A5D\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4863BE36-D16A-4D75-90D9-FD76DB5B48B7\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-updates/2016-09/msg00078.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.debian.org/security/2016/dsa-3619\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2016/05/29/5\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\"]},{\"url\":\"http://www.ubuntu.com/usn/USN-3030-1\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://github.com/libgd/libgd/commit/4dc1a2d7931017d3625f2d7cff70a17ce58b53b4\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/libgd/libgd/issues/211\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]}]}}" } }
Loading...
Loading...
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.