Home > Vulnerability Database > CVE-2016-6912

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2016-6912

Good to know:

Date: January 26, 2017

Double free vulnerability in the gdImageWebPtr function in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via large width and height values.

Language: C

Severity Score

9.8

Related Resources (8)

Url: http://www.debian.org/security/2017/dsa-3777

Url: http://www.securityfocus.com/bid/95843

Url: https://github.com/libgd/libgd/blob/gd-2.2.4/CHANGELOG.md

Url: https://github.com/libgd/libgd/commit/a49feeae76d41959d85ee733925a4cf40bac61b2

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2016-6912

Url: https://nvd.nist.gov/vuln/detail/CVE-2016-6912

Url: https://security-tracker.debian.org/tracker/CVE-2016-6912

Url: https://www.mend.io/vulnerability-database/CVE-2016-6912

Severity Score

9.8

Weakness Type (CWE)

Double Free

CWE-415

Top Fix

Upgrade Version

Upgrade to version 2.2.4

CVSS v3.1

Base Score:	9.8
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	HIGH

CVSS v2

Base Score:	7.5
Access Vector (AV):	NETWORK
Access Complexity (AC):	LOW
Authentication (AU):	NONE
Confidentiality (C):	PARTIAL
Integrity (I):	PARTIAL
Availability (A):	PARTIAL
Additional information:

Do you need more information?

Contact Us