blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2016-7568

CRITICAL 9.8 CVSS 3.0
Published
September 28, 2016
Last modified
June 17, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-190
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

Integer overflow in the gdImageWebpCtx function in gd_webp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP through 7.0.11, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted imagewebp and imagedestroy calls.

Affected products and versions

  • PHP — From 5.6.0 (including) to 5.6.26 (including)
  • PHP — From 7.0.0 (including) to 7.0.11 (including)

References

  • www.debian.org http://www.debian.org/security/2016/dsa-3693 Third Party Advisory
  • www.securityfocus.com http://www.securityfocus.com/bid/93184 Third Party Advisory, VDB Entry
  • bugs.php.net https://bugs.php.net/bug.php?id=73003 Issue Tracking, Vendor Advisory
  • github.com https://github.com/libgd/libgd/commit/40bec0f38f50e8510f5bb71a82f516d46facde03 Issue Tracking, Patch, Third Party Advisory
  • github.com https://github.com/libgd/libgd/issues/308 Issue Tracking, Patch, Third Party Advisory
  • github.com https://github.com/php/php-src/commit/c18263e0e0769faee96a5d0ee04b750c442783c6 Issue Tracking, Patch, Third Party Advisory
  • security.gentoo.org https://security.gentoo.org/glsa/201612-09 Third Party Advisory
  • nvd.nist.gov Official NVD record