Denial of Service Vulnerability in GD Graphics Library (gd) - CVE-2016-6132
Summary
ALPINE-CVE-2016-6132: The gdImageCreateFromTgaCtx function in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file. Affects gd versions < 2.2.3-r0. Fixed in 2.2.3-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The GD Graphics Library, commonly referred to as libgd, is a widely used open-source library for the dynamic creation of images by programmers. It supports various image formats, including PNG, JPEG, and GIF, and is often utilized in web applications for generating graphics on-the-fly. However, prior to version 2.2.3, the library was susceptible to a vulnerability that could be exploited through specially crafted TGA files, leading to potential denial of service.
Vulnerability Detail
The vulnerability identified as CVE-2016-6132 exists in the gdImageCreateFromTgaCtx function of the GD Graphics Library before version 2.2.3. This flaw allows remote attackers to exploit the library by sending a maliciously crafted TGA file, which can trigger an out-of-bounds read. The consequences of this vulnerability can lead to application crashes or unexpected behavior, effectively causing a denial of service. The vulnerability has a CVSS score of 6.5, indicating a moderate level of risk.
How To Fix
Minimum fixed version
2.2.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade gdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation to reject any TGA files that do not conform to expected formats. This can help mitigate the risk of exploitation until the library is updated.
Conclusion
CVE-2016-6132 represents a significant vulnerability in the GD Graphics Library that can lead to denial of service through the exploitation of crafted TGA files. It is crucial for users of the library to update to the patched version to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for gd →
FAQ
CVE-2016-6132 is a vulnerability in the GD Graphics Library that allows remote attackers to cause a denial of service via a crafted TGA file.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary risk is denial of service, where the application may crash or behave unexpectedly when processing malicious TGA files.
Yes, the vulnerability is patched in version 2.2.3 of the GD Graphics Library. It is recommended to update to this version or later.
The CVSS score of CVE-2016-6132 is 6.5, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for gd.
