Skip to content
OpenAdvisories
Medium ALAS2-2021-1577 1 CVE

Moderate: gd security update (Amazon Linux 2)

Published Jan 5, 2021 · Updated Jan 7, 2021

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2016-5766: An integer overflow, leading to a heap-based buffer overflow was found in the imagecreatefromgd2() function of PHP's gd extension. A remote attacker could use this flaw to crash a PHP application or execute arbitrary code with the privileges of the user running that PHP application, using gd via a specially crafted GD2 image. An integer overflow flaw, leading to a heap-based buffer overflow was found in the imagecreatefromgd2() function of PHP's gd extension. A remote attacker could use this flaw to crash a PHP application or execute arbitrary code with the privileges of the user running that PHP application using gd via a specially crafted GD2 image. 1351068: CVE-2016-5766 gd: Integer overflow in _gd2GetHeader() resulting in heap overflow 1351068: CVE-2016-5766 gd: Integer Overflow in _gd2GetHeader() resulting in heap overflow

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2 gd 0:2.0.35-27.amzn2
Amazon Linux · 2 gd-debuginfo 0:2.0.35-27.amzn2
Amazon Linux · 2 gd-devel 0:2.0.35-27.amzn2
Amazon Linux · 2 gd-progs 0:2.0.35-27.amzn2

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2016-5766.html