CVE-2016-6128

HIGH 7.5CVE-2016-6128 · Published 07/08/2016 · updated 17/06/2026

In short

CVE-2016-6128 is a HIGH (CVSS 7.5) vulnerability affecting libgd (libgd).
Chance of exploitation in the next 30 days (EPSS): 6.8%, higher than 94.0% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
libgd libgd	`≤ 2.2.2`	No fix yet

Description

The gdImageCropThreshold function in gd_crop.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 7.0.9, allows remote attackers to cause a denial of service (application crash) via an invalid color index.

References

lists.opensuse.org/opensuse-updates/2016-08/msg00086.html · Mailing List
lists.opensuse.org/opensuse-updates/2016-09/msg00078.html · Mailing List
rhn.redhat.com/errata/RHSA-2016-2750.html · Third Party Advisory
debian.org/security/2016/dsa-3619 · Third Party Advisory
openwall.com/lists/oss-security/2016/06/30/1 · Mailing List
securityfocus.com/bid/91509 · Third Party Advisory
securitytracker.com/id/1036276 · Third Party Advisory
ubuntu.com/usn/USN-3030-1 · Third Party Advisory
bugs.php.net/72494 · Issue Tracking
libgd/libgd commit 1ccfe21 · Issue Tracking
libgd/libgd commit 6ff72ae · Issue Tracking
libgd.github.io/release-2.2.3.html

More vulnerabilities in libgd

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

libgd

≤ 2.2.2

No fix yet

More vulnerabilities in libgd

See all →