CVE-2016-6911

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

The dynamicGetbuf function in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TIFF image.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.debian.org/security/2016/dsa-3693
http://www.securityfocus.com/bid/95840
https://github.com/libgd/libgd/blob/gd-2.2.4/CHANGELOG.mdIssue Tracking, Patch, Release Notes, Third Party Advisory
https://github.com/libgd/libgd/commit/4859d69e07504d4b0a4bdf9bcb4d9e3769ca35aeIssue Tracking, Patch, Third Party Advisory
https://github.com/libgd/libgd/pull/353Issue Tracking, Patch, Third Party Advisory
http://www.debian.org/security/2016/dsa-3693
http://www.securityfocus.com/bid/95840
https://github.com/libgd/libgd/blob/gd-2.2.4/CHANGELOG.mdIssue Tracking, Patch, Release Notes, Third Party Advisory
https://github.com/libgd/libgd/commit/4859d69e07504d4b0a4bdf9bcb4d9e3769ca35aeIssue Tracking, Patch, Third Party Advisory
https://github.com/libgd/libgd/pull/353Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Jan 26, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-69129.8Double free vulnerability in the gdImageWebPtr function in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have CVE-2016-69135.4Cross-site scripting (XSS) vulnerability in AlienVault OSSIM before 5.3 and USM before 5.3 allows remote attackers to inject arbitrary web s CVE-2016-69147.8Ubiquiti UniFi Video before 3.8.0 for Windows uses weak permissions for the installation directory, which allows local users to gain SYSTEM CVE-2016-69157.8Stack-based buffer overflow in nvhost_job.c in the NVIDIA video driver for Android, Shield TV before OTA 3.3, Shield Table before OTA 4.4, a CVE-2016-69167.8Integer overflow in nvhost_job.c in the NVIDIA video driver for Android, Shield TV before OTA 3.3, Shield Table before OTA 4.4, and Shield T CVE-2016-69177.8Buffer overflow in nvhost_job.c in the NVIDIA video driver for Android, Shield TV before OTA 3.3, Shield Table before OTA 4.4, and Shield Ta CVE-2016-69189.8Lexmark Markvision Enterprise (MVE) before 2.4.1 allows remote attackers to execute arbitrary commands by uploading files. (CVE-2016-69207.5Heap-based buffer overflow in the decode_block function in libavcodec/exr.c in FFmpeg before 3.1.3 allows remote attackers to cause a denial CVE-2016-69218.8Use-after-free vulnerability in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before CVE-2016-69228.8Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows att CVE-2016-69238.8Use-after-free vulnerability in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before CVE-2016-69248.8Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows att