Read the docs
TI-2016-05007 Aliases CVE-2016-5766GHSA-54vf-4pr8-g7c8

Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library…

Priority MEDIUM 48CWE-190Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 14 fixed, 4 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-190 and the CVSS impact.

Summary

Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via crafted chunk dimensions in an image.

Why it matters now

EPSS 0.07495 94th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Partial Red Hat: 3 advisoriesRed Hat: 14 fixed, 4 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 62

CPEVersionsRoleVendor
cpe:2.3:o:redhat:openshift:2.0:*:enterprise:*:*:*:*:*2.0VulnerableRed Hat
cpe:2.3:o:freebsd:freebsd:8.3:*:*:*:*:*:*:*8.3VulnerableFreeBSD
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:freebsd:freebsd:8.0:*:*:*:*:*:*:*8.0VulnerableFreeBSD
cpe:2.3:o:redhat:enterprise_linux:5:*:*:*:*:*:*:*5VulnerableRed Hat
cpe:2.3:a:libgd:libgd:2.2.2:*:*:*:*:*:*:*2.2.2VulnerableLibgd
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*up to 5.5.36Running onPHP
cpe:2.3:a:php:php:5.6.0:alpha1:*:*:*:*:*:*5.6.0 alpha1Running onPHP
cpe:2.3:a:php:php:5.6.0:alpha2:*:*:*:*:*:*5.6.0 alpha2Running onPHP
cpe:2.3:a:php:php:5.6.0:alpha3:*:*:*:*:*:*5.6.0 alpha3Running onPHP
  • cpe:2.3:o:redhat:openshift:2.0:*:enterprise:*:*:*:*:* Versions 2.0 Vulnerable ·Red Hat
  • cpe:2.3:o:freebsd:freebsd:8.3:*:*:*:*:*:*:* Versions 8.3 Vulnerable ·FreeBSD
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:freebsd:freebsd:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·FreeBSD
  • cpe:2.3:o:redhat:enterprise_linux:5:*:*:*:*:*:*:* Versions 5 Vulnerable ·Red Hat
  • cpe:2.3:a:libgd:libgd:2.2.2:*:*:*:*:*:*:* Versions 2.2.2 Vulnerable ·Libgd
  • cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Versions up to 5.5.36 Running on ·PHP
  • cpe:2.3:a:php:php:5.6.0:alpha1:*:*:*:*:*:* Versions 5.6.0 alpha1 Running on ·PHP
  • cpe:2.3:a:php:php:5.6.0:alpha2:*:*:*:*:*:* Versions 5.6.0 alpha2 Running on ·PHP
  • cpe:2.3:a:php:php:5.6.0:alpha3:*:*:*:*:*:* Versions 5.6.0 alpha3 Running on ·PHP
Show 52 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:php:php:5.6.0:alpha4:*:*:*:*:*:*5.6.0 alpha4Running onPHP
cpe:2.3:a:php:php:5.6.0:alpha5:*:*:*:*:*:*5.6.0 alpha5Running onPHP
cpe:2.3:a:php:php:5.6.0:beta1:*:*:*:*:*:*5.6.0 beta1Running onPHP
cpe:2.3:a:php:php:5.6.0:beta2:*:*:*:*:*:*5.6.0 beta2Running onPHP
cpe:2.3:a:php:php:5.6.0:beta3:*:*:*:*:*:*5.6.0 beta3Running onPHP
cpe:2.3:a:php:php:5.6.0:beta4:*:*:*:*:*:*5.6.0 beta4Running onPHP
cpe:2.3:a:php:php:5.6.1:*:*:*:*:*:*:*5.6.1Running onPHP
cpe:2.3:a:php:php:5.6.2:*:*:*:*:*:*:*5.6.2Running onPHP
cpe:2.3:a:php:php:5.6.3:*:*:*:*:*:*:*5.6.3Running onPHP
cpe:2.3:a:php:php:5.6.4:*:*:*:*:*:*:*5.6.4Running onPHP
cpe:2.3:a:php:php:5.6.5:*:*:*:*:*:*:*5.6.5Running onPHP
cpe:2.3:a:php:php:5.6.6:*:*:*:*:*:*:*5.6.6Running onPHP
cpe:2.3:a:php:php:5.6.7:*:*:*:*:*:*:*5.6.7Running onPHP
cpe:2.3:a:php:php:5.6.8:*:*:*:*:*:*:*5.6.8Running onPHP
cpe:2.3:a:php:php:5.6.9:*:*:*:*:*:*:*5.6.9Running onPHP
cpe:2.3:a:php:php:5.6.10:*:*:*:*:*:*:*5.6.10Running onPHP
cpe:2.3:a:php:php:5.6.11:*:*:*:*:*:*:*5.6.11Running onPHP
cpe:2.3:a:php:php:5.6.12:*:*:*:*:*:*:*5.6.12Running onPHP
cpe:2.3:a:php:php:5.6.13:*:*:*:*:*:*:*5.6.13Running onPHP
cpe:2.3:a:php:php:5.6.14:*:*:*:*:*:*:*5.6.14Running onPHP
cpe:2.3:a:php:php:5.6.15:*:*:*:*:*:*:*5.6.15Running onPHP
cpe:2.3:a:php:php:5.6.16:*:*:*:*:*:*:*5.6.16Running onPHP
cpe:2.3:a:php:php:5.6.17:*:*:*:*:*:*:*5.6.17Running onPHP
cpe:2.3:a:php:php:5.6.18:*:*:*:*:*:*:*5.6.18Running onPHP
cpe:2.3:a:php:php:5.6.19:*:*:*:*:*:*:*5.6.19Running onPHP
cpe:2.3:a:php:php:5.6.20:*:*:*:*:*:*:*5.6.20Running onPHP
cpe:2.3:a:php:php:5.6.21:*:*:*:*:*:*:*5.6.21Running onPHP
cpe:2.3:a:php:php:5.6.22:*:*:*:*:*:*:*5.6.22Running onPHP
cpe:2.3:a:php:php:7.0.0:*:*:*:*:*:*:*7.0.0Running onPHP
cpe:2.3:a:php:php:7.0.1:*:*:*:*:*:*:*7.0.1Running onPHP
cpe:2.3:a:php:php:7.0.2:*:*:*:*:*:*:*7.0.2Running onPHP
cpe:2.3:a:php:php:7.0.3:*:*:*:*:*:*:*7.0.3Running onPHP
cpe:2.3:a:php:php:7.0.4:*:*:*:*:*:*:*7.0.4Running onPHP
cpe:2.3:a:php:php:7.0.5:*:*:*:*:*:*:*7.0.5Running onPHP
cpe:2.3:a:php:php:7.0.6:*:*:*:*:*:*:*7.0.6Running onPHP
cpe:2.3:a:php:php:7.0.7:*:*:*:*:*:*:*7.0.7Running onPHP
cpe:2.3:o:freebsd:freebsd:10.0:*:*:*:*:*:*:*10.0VulnerableFreeBSD
cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*23VulnerableFedoraproject
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
cpe:2.3:o:freebsd:freebsd:10.1:*:*:*:*:*:*:*10.1VulnerableFreeBSD
cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*24VulnerableFedoraproject
cpe:2.3:o:freebsd:freebsd:8.4:*:*:*:*:*:*:*8.4VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:9.2:*:*:*:*:*:*:*9.2VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:8.2:*:*:*:*:*:*:*8.2VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:8.1:*:*:*:*:*:*:*8.1VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:9.0:*:*:*:*:*:*:*9.0VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:10.2:*:*:*:*:*:*:*10.2VulnerableFreeBSD
cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*22VulnerableFedoraproject
cpe:2.3:o:freebsd:freebsd:9.3:*:*:*:*:*:*:*9.3VulnerableFreeBSD
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:freebsd:freebsd:10.3:*:*:*:*:*:*:*10.3VulnerableFreeBSD
cpe:2.3:o:freebsd:freebsd:9.1:*:*:*:*:*:*:*9.1VulnerableFreeBSD
  • cpe:2.3:a:php:php:5.6.0:alpha4:*:*:*:*:*:* Versions 5.6.0 alpha4 Running on ·PHP
  • cpe:2.3:a:php:php:5.6.0:alpha5:*:*:*:*:*:* Versions 5.6.0 alpha5 Running on ·PHP
  • cpe:2.3:a:php:php:5.6.0:beta1:*:*:*:*:*:* Versions 5.6.0 beta1 Running on ·PHP
  • cpe:2.3:a:php:php:5.6.0:beta2:*:*:*:*:*:* Versions 5.6.0 beta2 Running on ·PHP
  • cpe:2.3:a:php:php:5.6.0:beta3:*:*:*:*:*:* Versions 5.6.0 beta3 Running on ·PHP
  • cpe:2.3:a:php:php:5.6.0:beta4:*:*:*:*:*:* Versions 5.6.0 beta4 Running on ·PHP
  • cpe:2.3:a:php:php:5.6.1:*:*:*:*:*:*:* Versions 5.6.1 Running on ·PHP
  • cpe:2.3:a:php:php:5.6.2:*:*:*:*:*:*:* Versions 5.6.2 Running on ·PHP
  • cpe:2.3:a:php:php:5.6.3:*:*:*:*:*:*:* Versions 5.6.3 Running on ·PHP
  • cpe:2.3:a:php:php:5.6.4:*:*:*:*:*:*:* Versions 5.6.4 Running on ·PHP
  • cpe:2.3:a:php:php:5.6.5:*:*:*:*:*:*:* Versions 5.6.5 Running on ·PHP
  • cpe:2.3:a:php:php:5.6.6:*:*:*:*:*:*:* Versions 5.6.6 Running on ·PHP
  • cpe:2.3:a:php:php:5.6.7:*:*:*:*:*:*:* Versions 5.6.7 Running on ·PHP
  • cpe:2.3:a:php:php:5.6.8:*:*:*:*:*:*:* Versions 5.6.8 Running on ·PHP
  • cpe:2.3:a:php:php:5.6.9:*:*:*:*:*:*:* Versions 5.6.9 Running on ·PHP
  • cpe:2.3:a:php:php:5.6.10:*:*:*:*:*:*:* Versions 5.6.10 Running on ·PHP
  • cpe:2.3:a:php:php:5.6.11:*:*:*:*:*:*:* Versions 5.6.11 Running on ·PHP
  • cpe:2.3:a:php:php:5.6.12:*:*:*:*:*:*:* Versions 5.6.12 Running on ·PHP
  • cpe:2.3:a:php:php:5.6.13:*:*:*:*:*:*:* Versions 5.6.13 Running on ·PHP
  • cpe:2.3:a:php:php:5.6.14:*:*:*:*:*:*:* Versions 5.6.14 Running on ·PHP
  • cpe:2.3:a:php:php:5.6.15:*:*:*:*:*:*:* Versions 5.6.15 Running on ·PHP
  • cpe:2.3:a:php:php:5.6.16:*:*:*:*:*:*:* Versions 5.6.16 Running on ·PHP
  • cpe:2.3:a:php:php:5.6.17:*:*:*:*:*:*:* Versions 5.6.17 Running on ·PHP
  • cpe:2.3:a:php:php:5.6.18:*:*:*:*:*:*:* Versions 5.6.18 Running on ·PHP
  • cpe:2.3:a:php:php:5.6.19:*:*:*:*:*:*:* Versions 5.6.19 Running on ·PHP
  • cpe:2.3:a:php:php:5.6.20:*:*:*:*:*:*:* Versions 5.6.20 Running on ·PHP
  • cpe:2.3:a:php:php:5.6.21:*:*:*:*:*:*:* Versions 5.6.21 Running on ·PHP
  • cpe:2.3:a:php:php:5.6.22:*:*:*:*:*:*:* Versions 5.6.22 Running on ·PHP
  • cpe:2.3:a:php:php:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Running on ·PHP
  • cpe:2.3:a:php:php:7.0.1:*:*:*:*:*:*:* Versions 7.0.1 Running on ·PHP
  • cpe:2.3:a:php:php:7.0.2:*:*:*:*:*:*:* Versions 7.0.2 Running on ·PHP
  • cpe:2.3:a:php:php:7.0.3:*:*:*:*:*:*:* Versions 7.0.3 Running on ·PHP
  • cpe:2.3:a:php:php:7.0.4:*:*:*:*:*:*:* Versions 7.0.4 Running on ·PHP
  • cpe:2.3:a:php:php:7.0.5:*:*:*:*:*:*:* Versions 7.0.5 Running on ·PHP
  • cpe:2.3:a:php:php:7.0.6:*:*:*:*:*:*:* Versions 7.0.6 Running on ·PHP
  • cpe:2.3:a:php:php:7.0.7:*:*:*:*:*:*:* Versions 7.0.7 Running on ·PHP
  • cpe:2.3:o:freebsd:freebsd:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·FreeBSD
  • cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:* Versions 23 Vulnerable ·Fedoraproject
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
  • cpe:2.3:o:freebsd:freebsd:10.1:*:*:*:*:*:*:* Versions 10.1 Vulnerable ·FreeBSD
  • cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:* Versions 24 Vulnerable ·Fedoraproject
  • cpe:2.3:o:freebsd:freebsd:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:10.2:*:*:*:*:*:*:* Versions 10.2 Vulnerable ·FreeBSD
  • cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:* Versions 22 Vulnerable ·Fedoraproject
  • cpe:2.3:o:freebsd:freebsd:9.3:*:*:*:*:*:*:* Versions 9.3 Vulnerable ·FreeBSD
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:freebsd:freebsd:10.3:*:*:*:*:*:*:* Versions 10.3 Vulnerable ·FreeBSD
  • cpe:2.3:o:freebsd:freebsd:9.1:*:*:*:*:*:*:* Versions 9.1 Vulnerable ·FreeBSD

Remediation

Red Hat 3 advisories

  • RHSA-2020:5443 Released 2020-12-15 · Red Hat rating Moderate
    gd security update
    • Red Hat Enterprise Linux Client (v. 7) gd-2.0.35-27.el7_9
    • Red Hat Enterprise Linux Client Optional (v. 7) gd-devel-2.0.35-27.el7_9, gd-progs-2.0.35-27.el7_9
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) gd-devel-2.0.35-27.el7_9, gd-progs-2.0.35-27.el7_9
    • Red Hat Enterprise Linux Server (v. 7) gd-2.0.35-27.el7_9, gd-2.0.35-27.el7_9.ppc
    • Red Hat Enterprise Linux Server Optional (v. 7) gd-devel-2.0.35-27.el7_9, gd-devel-2.0.35-27.el7_9.ppc, gd-progs-2.0.35-27.el7_9
    • Red Hat Enterprise Linux Workstation (v. 7) gd-2.0.35-27.el7_9
    • Red Hat Enterprise Linux Workstation Optional (v. 7) gd-devel-2.0.35-27.el7_9, gd-progs-2.0.35-27.el7_9
  • RHSA-2016:2750 Released 2016-11-15 · Red Hat rating Moderate
    rh-php56 security, bug fix, and enhancement update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-php56-2.3-1.el6, rh-php56-php-5.6.25-1.el6, rh-php56-php-bcmath-5.6.25-1.el6 +30
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-php56-2.3-1.el7, rh-php56-php-5.6.25-1.el7, rh-php56-php-bcmath-5.6.25-1.el7 +28
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) rh-php56-2.3-1.el6, rh-php56-php-5.6.25-1.el6, rh-php56-php-bcmath-5.6.25-1.el6 +30
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2) rh-php56-2.3-1.el7, rh-php56-php-5.6.25-1.el7, rh-php56-php-bcmath-5.6.25-1.el7 +28
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) rh-php56-2.3-1.el7, rh-php56-php-5.6.25-1.el7, rh-php56-php-bcmath-5.6.25-1.el7 +28
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-php56-2.3-1.el6, rh-php56-php-5.6.25-1.el6, rh-php56-php-bcmath-5.6.25-1.el6 +30
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-php56-2.3-1.el7, rh-php56-php-5.6.25-1.el7, rh-php56-php-bcmath-5.6.25-1.el7 +28
  • RHSA-2016:2598 Released 2016-11-03 · Red Hat rating Moderate
    php security and bug fix update
    • Red Hat Enterprise Linux Client Optional (v. 7) php-5.4.16-42.el7, php-bcmath-5.4.16-42.el7, php-cli-5.4.16-42.el7 +22
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) php-5.4.16-42.el7, php-bcmath-5.4.16-42.el7, php-cli-5.4.16-42.el7 +22
    • Red Hat Enterprise Linux Server (v. 7) php-5.4.16-42.el7, php-cli-5.4.16-42.el7, php-common-5.4.16-42.el7 +11
    • Red Hat Enterprise Linux Server Optional (v. 7) php-bcmath-5.4.16-42.el7, php-dba-5.4.16-42.el7, php-devel-5.4.16-42.el7 +8
    • Red Hat Enterprise Linux Workstation (v. 7) php-5.4.16-42.el7, php-cli-5.4.16-42.el7, php-common-5.4.16-42.el7 +11
    • Red Hat Enterprise Linux Workstation Optional (v. 7) php-bcmath-5.4.16-42.el7, php-dba-5.4.16-42.el7, php-devel-5.4.16-42.el7 +8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 5AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Will not fix
Red Hat OpenShift Enterprise 2AffectedNo fix yet
Red Hat Software CollectionsAffectedNo fix planned: Will not fix
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2020:5443
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2016:2598, RHSA-2020:5443
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2016:2598, RHSA-2020:5443
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2016:2598, RHSA-2020:5443
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2016:2598, RHSA-2020:5443
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2016:2598, RHSA-2020:5443
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2016:2598, RHSA-2020:5443
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2016:2750
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2016:2750
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)Fixed RHSA-2016:2750
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)Fixed RHSA-2016:2750
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)Fixed RHSA-2016:2750
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2016:2750
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2016:2750
Not affected: 1 product
  • Red Hat Enterprise Linux 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-5766
  2. 2026-10-03 Alias added: GHSA-54vf-4pr8-g7c8

References

Exploit 2

Advisory 8

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences