Read the docs
TI-2016-04422 Aliases CVE-2016-5116GHSA-mvgw-h4r7-8g56

gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom…

Priority MEDIUM 46CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name.

Why it matters now

EPSS 0.03809 90th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 49

CPEVersionsRoleVendor
cpe:2.3:a:libgd:libgd:*:*:*:*:*:*:*:*up to 2.2.1VulnerableLibgd
cpe:2.3:a:php:php:5.5.0:*:*:*:*:*:*:*5.5.0Running onPHP
cpe:2.3:a:php:php:5.5.0:alpha1:*:*:*:*:*:*5.5.0 alpha1Running onPHP
cpe:2.3:a:php:php:5.5.0:alpha2:*:*:*:*:*:*5.5.0 alpha2Running onPHP
cpe:2.3:a:php:php:5.5.0:alpha3:*:*:*:*:*:*5.5.0 alpha3Running onPHP
cpe:2.3:a:php:php:5.5.0:alpha4:*:*:*:*:*:*5.5.0 alpha4Running onPHP
cpe:2.3:a:php:php:5.5.0:alpha5:*:*:*:*:*:*5.5.0 alpha5Running onPHP
cpe:2.3:a:php:php:5.5.0:alpha6:*:*:*:*:*:*5.5.0 alpha6Running onPHP
cpe:2.3:a:php:php:5.5.0:beta1:*:*:*:*:*:*5.5.0 beta1Running onPHP
cpe:2.3:a:php:php:5.5.0:beta2:*:*:*:*:*:*5.5.0 beta2Running onPHP
  • cpe:2.3:a:libgd:libgd:*:*:*:*:*:*:*:* Versions up to 2.2.1 Vulnerable ·Libgd
  • cpe:2.3:a:php:php:5.5.0:*:*:*:*:*:*:* Versions 5.5.0 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.0:alpha1:*:*:*:*:*:* Versions 5.5.0 alpha1 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.0:alpha2:*:*:*:*:*:* Versions 5.5.0 alpha2 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.0:alpha3:*:*:*:*:*:* Versions 5.5.0 alpha3 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.0:alpha4:*:*:*:*:*:* Versions 5.5.0 alpha4 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.0:alpha5:*:*:*:*:*:* Versions 5.5.0 alpha5 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.0:alpha6:*:*:*:*:*:* Versions 5.5.0 alpha6 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.0:beta1:*:*:*:*:*:* Versions 5.5.0 beta1 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.0:beta2:*:*:*:*:*:* Versions 5.5.0 beta2 Running on ·PHP
Show 39 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:php:php:5.5.0:beta3:*:*:*:*:*:*5.5.0 beta3Running onPHP
cpe:2.3:a:php:php:5.5.0:beta4:*:*:*:*:*:*5.5.0 beta4Running onPHP
cpe:2.3:a:php:php:5.5.0:rc1:*:*:*:*:*:*5.5.0 rc1Running onPHP
cpe:2.3:a:php:php:5.5.0:rc2:*:*:*:*:*:*5.5.0 rc2Running onPHP
cpe:2.3:a:php:php:5.5.1:*:*:*:*:*:*:*5.5.1Running onPHP
cpe:2.3:a:php:php:5.5.2:*:*:*:*:*:*:*5.5.2Running onPHP
cpe:2.3:a:php:php:5.5.3:*:*:*:*:*:*:*5.5.3Running onPHP
cpe:2.3:a:php:php:5.5.4:*:*:*:*:*:*:*5.5.4Running onPHP
cpe:2.3:a:php:php:5.5.5:*:*:*:*:*:*:*5.5.5Running onPHP
cpe:2.3:a:php:php:5.5.6:*:*:*:*:*:*:*5.5.6Running onPHP
cpe:2.3:a:php:php:5.5.7:*:*:*:*:*:*:*5.5.7Running onPHP
cpe:2.3:a:php:php:5.5.8:*:*:*:*:*:*:*5.5.8Running onPHP
cpe:2.3:a:php:php:5.5.9:*:*:*:*:*:*:*5.5.9Running onPHP
cpe:2.3:a:php:php:5.5.10:*:*:*:*:*:*:*5.5.10Running onPHP
cpe:2.3:a:php:php:5.5.11:*:*:*:*:*:*:*5.5.11Running onPHP
cpe:2.3:a:php:php:5.5.12:*:*:*:*:*:*:*5.5.12Running onPHP
cpe:2.3:a:php:php:5.5.13:*:*:*:*:*:*:*5.5.13Running onPHP
cpe:2.3:a:php:php:5.5.14:*:*:*:*:*:*:*5.5.14Running onPHP
cpe:2.3:a:php:php:5.5.18:*:*:*:*:*:*:*5.5.18Running onPHP
cpe:2.3:a:php:php:5.5.19:*:*:*:*:*:*:*5.5.19Running onPHP
cpe:2.3:a:php:php:5.5.20:*:*:*:*:*:*:*5.5.20Running onPHP
cpe:2.3:a:php:php:5.5.21:*:*:*:*:*:*:*5.5.21Running onPHP
cpe:2.3:a:php:php:5.5.22:*:*:*:*:*:*:*5.5.22Running onPHP
cpe:2.3:a:php:php:5.5.23:*:*:*:*:*:*:*5.5.23Running onPHP
cpe:2.3:a:php:php:5.5.24:*:*:*:*:*:*:*5.5.24Running onPHP
cpe:2.3:a:php:php:5.5.25:*:*:*:*:*:*:*5.5.25Running onPHP
cpe:2.3:a:php:php:5.5.26:*:*:*:*:*:*:*5.5.26Running onPHP
cpe:2.3:a:php:php:5.5.27:*:*:*:*:*:*:*5.5.27Running onPHP
cpe:2.3:a:php:php:5.5.28:*:*:*:*:*:*:*5.5.28Running onPHP
cpe:2.3:a:php:php:5.5.29:*:*:*:*:*:*:*5.5.29Running onPHP
cpe:2.3:a:php:php:5.5.30:*:*:*:*:*:*:*5.5.30Running onPHP
cpe:2.3:a:php:php:5.5.31:*:*:*:*:*:*:*5.5.31Running onPHP
cpe:2.3:a:php:php:5.5.32:*:*:*:*:*:*:*5.5.32Running onPHP
cpe:2.3:a:php:php:5.5.33:*:*:*:*:*:*:*5.5.33Running onPHP
cpe:2.3:a:php:php:5.5.34:*:*:*:*:*:*:*5.5.34Running onPHP
cpe:2.3:a:php:php:5.5.35:*:*:*:*:*:*:*5.5.35Running onPHP
cpe:2.3:a:php:php:5.5.37:*:*:*:*:*:*:*5.5.37Running onPHP
cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*42.1VulnerableopenSUSE
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
  • cpe:2.3:a:php:php:5.5.0:beta3:*:*:*:*:*:* Versions 5.5.0 beta3 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.0:beta4:*:*:*:*:*:* Versions 5.5.0 beta4 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.0:rc1:*:*:*:*:*:* Versions 5.5.0 rc1 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.0:rc2:*:*:*:*:*:* Versions 5.5.0 rc2 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.1:*:*:*:*:*:*:* Versions 5.5.1 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.2:*:*:*:*:*:*:* Versions 5.5.2 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.3:*:*:*:*:*:*:* Versions 5.5.3 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.4:*:*:*:*:*:*:* Versions 5.5.4 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.5:*:*:*:*:*:*:* Versions 5.5.5 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.6:*:*:*:*:*:*:* Versions 5.5.6 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.7:*:*:*:*:*:*:* Versions 5.5.7 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.8:*:*:*:*:*:*:* Versions 5.5.8 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.9:*:*:*:*:*:*:* Versions 5.5.9 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.10:*:*:*:*:*:*:* Versions 5.5.10 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.11:*:*:*:*:*:*:* Versions 5.5.11 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.12:*:*:*:*:*:*:* Versions 5.5.12 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.13:*:*:*:*:*:*:* Versions 5.5.13 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.14:*:*:*:*:*:*:* Versions 5.5.14 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.18:*:*:*:*:*:*:* Versions 5.5.18 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.19:*:*:*:*:*:*:* Versions 5.5.19 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.20:*:*:*:*:*:*:* Versions 5.5.20 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.21:*:*:*:*:*:*:* Versions 5.5.21 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.22:*:*:*:*:*:*:* Versions 5.5.22 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.23:*:*:*:*:*:*:* Versions 5.5.23 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.24:*:*:*:*:*:*:* Versions 5.5.24 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.25:*:*:*:*:*:*:* Versions 5.5.25 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.26:*:*:*:*:*:*:* Versions 5.5.26 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.27:*:*:*:*:*:*:* Versions 5.5.27 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.28:*:*:*:*:*:*:* Versions 5.5.28 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.29:*:*:*:*:*:*:* Versions 5.5.29 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.30:*:*:*:*:*:*:* Versions 5.5.30 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.31:*:*:*:*:*:*:* Versions 5.5.31 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.32:*:*:*:*:*:*:* Versions 5.5.32 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.33:*:*:*:*:*:*:* Versions 5.5.33 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.34:*:*:*:*:*:*:* Versions 5.5.34 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.35:*:*:*:*:*:*:* Versions 5.5.35 Running on ·PHP
  • cpe:2.3:a:php:php:5.5.37:*:*:*:*:*:*:* Versions 5.5.37 Running on ·PHP
  • cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:* Versions 42.1 Vulnerable ·openSUSE
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 4 products
  • Red Hat Enterprise Linux 5
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat OpenShift Enterprise 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-5116
  2. 2026-10-03 Alias added: GHSA-mvgw-h4r7-8g56
  3. 2026-10-30 EPSS moved to the 90th–95th percentile

References

Patch 1

Advisory 4

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences