Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2016-5766: An integer overflow, leading to a heap-based buffer overflow was found in the imagecreatefromgd2() function of PHP's gd extension. A remote attacker could use this flaw to crash a PHP application or execute arbitrary code with the privileges of the user running that PHP application, using gd via a specially crafted GD2 image. An integer overflow flaw, leading to a heap-based buffer overflow was found in the imagecreatefromgd2() function of PHP's gd extension. A remote attacker could use this flaw to crash a PHP application or execute arbitrary code with the privileges of the user running that PHP application using gd via a specially crafted GD2 image. 1351068: CVE-2016-5766 gd: Integer overflow in _gd2GetHeader() resulting in heap overflow 1351068: CVE-2016-5766 gd: Integer Overflow in _gd2GetHeader() resulting in heap overflow
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | gd | 0:2.0.35-27.amzn2 |
| Amazon Linux · 2 | gd-debuginfo | 0:2.0.35-27.amzn2 |
| Amazon Linux · 2 | gd-devel | 0:2.0.35-27.amzn2 |
| Amazon Linux · 2 | gd-progs | 0:2.0.35-27.amzn2 |
Vulnerabilities 1
-
Unscored —
Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.3, as used…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2016-5766.html