CVE-2016-5766: Debian Linux

High severity, CVSS 8.8. EPSS: 7.5% chance of exploitation in the next 30 days.

Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via crafted chunk dimensions in an image.

Affected products

• Debian Debian Linux: version 8.0 only
• Fedoraproject Fedora: version 23 only; version 24 only; version 22 only
• Freebsd Freebsd: version 8.3 only; version 8.0 only; version 10.0 only; version 10.1 only; version 8.4 only; version 9.2 only; …
• Libgd Libgd: version 2.2.2 only
• Red Hat Enterprise Linux: version 6.0 only; version 5 only; version 7.0 only
• Red Hat Openshift: version 2.0 only

Published 2016-08-07. Last modified 2026-06-17.