CVE-2016-7568

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Integer overflow in the gdImageWebpCtx function in gd_webp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP through 7.0.11, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted imagewebp and imagedestroy calls.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.debian.org/security/2016/dsa-3693Third Party Advisory
http://www.securityfocus.com/bid/93184Third Party Advisory, VDB Entry
https://bugs.php.net/bug.php?id=73003Issue Tracking, Vendor Advisory
https://github.com/libgd/libgd/commit/40bec0f38f50e8510f5bb71a82f516d46facde03Issue Tracking, Patch, Third Party Advisory
https://github.com/libgd/libgd/issues/308Issue Tracking, Patch, Third Party Advisory
https://github.com/php/php-src/commit/c18263e0e0769faee96a5d0ee04b750c442783c6Issue Tracking, Patch, Third Party Advisory
https://security.gentoo.org/glsa/201612-09Third Party Advisory
http://www.debian.org/security/2016/dsa-3693Third Party Advisory
http://www.securityfocus.com/bid/93184Third Party Advisory, VDB Entry
https://bugs.php.net/bug.php?id=73003Issue Tracking, Vendor Advisory
https://github.com/libgd/libgd/commit/40bec0f38f50e8510f5bb71a82f516d46facde03Issue Tracking, Patch, Third Party Advisory
https://github.com/libgd/libgd/issues/308Issue Tracking, Patch, Third Party Advisory
https://github.com/php/php-src/commit/c18263e0e0769faee96a5d0ee04b750c442783c6Issue Tracking, Patch, Third Party Advisory
https://security.gentoo.org/glsa/201612-09Third Party Advisory

Timeline

Published: Sep 28, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-75695.5Directory traversal vulnerability in docker2aci before 0.13.0 allows remote attackers to write to arbitrary files via a .. (dot dot) in the CVE-2016-75704.3Drupal 8.x before 8.1.10 does not properly check for "Administer comments" permission, which allows remote authenticated users to set the vi CVE-2016-75716.1Cross-site scripting (XSS) vulnerability in Drupal 8.x before 8.1.10 allows remote attackers to inject arbitrary web script or HTML via vect CVE-2016-75724.3The system.temporary route in Drupal 8.x before 8.1.10 does not properly check for "Export configuration" permission, which allows remote au CVE-2016-75767.8In iOS before 9.3.3, a memory corruption issue existed in the kernel. This issue was addressed through improved memory handling.CVE-2016-75773.7An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. The issue involves the "Fa CVE-2016-75788.8An issue was discovered in certain Apple products. iOS before 10.1 is affected. Safari before 10.0.1 is affected. iCloud before 6.0.1 is aff CVE-2016-75795.9An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. tvOS before 10.0.1 is affe CVE-2016-75806.5An issue was discovered in certain Apple products. macOS before 10.12 is affected. The issue involves the "Mail" component, which allows rem CVE-2016-75814.3An issue was discovered in certain Apple products. iOS before 10.1 is affected. The issue involves the "Safari" component, which allows remo CVE-2016-75828.8An issue was discovered in certain Apple products. macOS before 10.12 is affected. The issue involves the "Intel Graphics Driver" component.CVE-2016-75837.8An issue was discovered in certain Apple products. iCloud before 6.0.1 is affected. The issue involves the setup subsystem in the "iCloud" c