Quick answers
- Is CVE-2016-6912 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2016-6912 being exploited in the wild.
- How severe is CVE-2016-6912?
- Critical severity, with a CVSS score of 9.8, published 26 January 2017.
- Which products and versions are affected?
- libgd libgd before 2.2.4.
- Is there a fix for CVE-2016-6912?
- A patch was published on 2017-01-31: Debian security update released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2016-6912 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2016-6912?
- Check whether you run Libgd. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A double free vulnerability exists in the gdImageWebPtr function within libgd (GD Graphics Library) prior to version 2.2.4. The root cause is a failure in gdImageWebpCtx() to communicate success or failure states to its caller, gdImageWebpPtr(). When an image exceeds WebP's maximum dimension limits (16,383 pixels), the underlying libwebp write fails, but the calling function incorrectly assumes success and attempts to free memory that may have already been released or improperly initialized. This can be exploited by a remote, unauthenticated attacker providing a specially crafted image to trigger memory corruption, leading to a denial of service or arbitrary code execution. The issue was addressed in version 2.2.4 by introducing a helper function that properly tracks and returns the success status of the WebP context operations.
Affected products
- libgd libgd before 2.2.4
Timeline
- 2017-01-26: disclosed: NVD publication date
- 2017-01-31: patched: Debian security update released