blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2016-9933

HIGH 7.5 CVSS 3.0
Published
January 4, 2017
Last modified
June 17, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-119
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Description

Stack consumption vulnerability in the gdImageFillToBorder function in gd.c in the GD Graphics Library (aka libgd) before 2.2.2, as used in PHP before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (segmentation violation) via a crafted imagefilltoborder call that triggers use of a negative color value.

References

  • lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2016-12/msg00133.html
  • lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2016-12/msg00142.html
  • lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2017-01/msg00002.html
  • lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2017-01/msg00034.html
  • lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2017-01/msg00054.html
  • www.debian.org http://www.debian.org/security/2017/dsa-3751
  • www.openwall.com http://www.openwall.com/lists/oss-security/2016/12/12/2 Third Party Advisory
  • www.php.net http://www.php.net/ChangeLog-5.php Release Notes, Vendor Advisory
  • www.php.net http://www.php.net/ChangeLog-7.php Release Notes, Vendor Advisory
  • www.securityfocus.com http://www.securityfocus.com/bid/94865
  • access.redhat.com https://access.redhat.com/errata/RHSA-2018:1296
  • bugs.php.net https://bugs.php.net/bug.php?id=72696 Vendor Advisory
  • github.com https://github.com/libgd/libgd/commit/77f619d48259383628c3ec4654b1ad578e9eb40e Patch, Vendor Advisory
  • github.com https://github.com/libgd/libgd/issues/215 Vendor Advisory
  • github.com https://github.com/php/php-src/commit/863d37ea66d5c960db08d6f4a2cbd2518f0f80d1 Vendor Advisory
  • nvd.nist.gov Official NVD record