Quick answers
- Is CVE-2016-6911 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2016-6911 being exploited in the wild.
- How severe is CVE-2016-6911?
- Medium severity, with a CVSS score of 5.5, published 26 January 2017.
- Which products and versions are affected?
- libgd libgd before 2.2.4.
- Is there a fix for CVE-2016-6911?
- A patch was published on 2017-01-18: libgd 2.2.4 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2016-6911 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2016-6911?
- Check whether you run Libgd. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An out-of-bounds read vulnerability exists in the dynamicGetbuf function within libgd's TIFF processing logic. The root cause is a failure to validate buffer boundaries when handling image data, specifically allowing for negative or excessively large offsets in the dp->pos pointer. When an application calls gdImageCreateFromTiffPtr() with a malformed TIFF file, the library may attempt to read memory outside the allocated buffer, leading to a crash (denial of service). The vulnerability was addressed in version 2.2.4 by adding bounds checks to dynamicGetbuf and ensuring the return value of TIFFReadRGBAImage is properly validated.
Affected products
- libgd libgd before 2.2.4
Timeline
- 2016-08-02: other: Internal patch developed by maintainers
- 2016-10-14: advisory: Debian security advisory DSA-3693-1 published
- 2017-01-26: disclosed: NVD publication date
- 2017-01-18: patched: libgd 2.2.4 released with fix