- Security fix for CVE-2016-8670

  - Security fix for CVE-2016-6911

  - Security fix for CVE-2016-7568

  - For Fedora 26 disabled two tests - they are failing     because of freetype 2.7     (https://github.com/libgd/libgd/issues/302,     https://github.com/libgd/libgd/issues/217)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of macOS that is 10.12.x prior to 10.12.3. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache_mod_php
  - Bluetooth
  - Graphics Drivers
  - Help Viewer
  - IOAudioFamily
  - Kernel
  - libarchive
  - Vim
  - WebKit

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

CVE-2016-6911 invalid read in gdImageCreateFromTiffPtr() (most of the code is not present in the Wheezy version)

CVE-2016-8670: Stack Buffer Overflow in GD dynamicGetbuf

For Debian 7 'Wheezy', these problems have been fixed in version 2.0.36~rc1~dfsg-6.1+deb7u6.

We recommend that you upgrade your libgd2 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 6.06, has gd packages installed that are affected by multiple vulnerabilities:

  - The GD Graphics Library (aka LibGD) 2.2.5 has a double free in the gdImage*Ptr() functions in     gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c. NOTE: PHP is unaffected. (CVE-2019-6978)

  - The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.x before 5.3.1, and the GD Graphics Library     2.x, does not properly verify a certain colorsTotal structure member, which might allow remote attackers     to conduct buffer overflow or buffer over-read attacks via a crafted GD file, a different vulnerability     than CVE-2009-3293. NOTE: some of these details are obtained from third party information. (CVE-2009-3546)

  - Buffer overflow in the gdImageStringFTEx function in gdft.c in GD Graphics Library 2.0.33 and earlier     allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary     code via a crafted string with a JIS encoded font. (CVE-2007-0455)

  - The gdImageCreateFromXpm function in gdxpm.c in libgd, as used in PHP 5.4.26 and earlier, allows remote     attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted     color table in an XPM file. (CVE-2014-2497)

  - Integer signedness error in GD Graphics Library 2.1.1 (aka libgd or libgd2) allows remote attackers to     cause a denial of service (crash) or potentially execute arbitrary code via crafted compressed gd2 data,     which triggers a heap-based buffer overflow. (CVE-2016-3074)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Integer signedness error in the dynamicGetbuf function in gd_io_dp.c in the GD Graphics Library (aka     libgd) through 2.2.3, as used in PHP before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause     a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted     imagecreatefromstring call. (CVE-2016-8670)

Note that Nessus relies on the presence of the package as reported by the vendor.

The CentOS Linux 7.9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0728 advisory.

    This advisory aggregates security fixes for the php SRPM in CIQ CentOS Bridge 7.9. It addresses 65 CVEs:
    CVE-2023-0568, CVE-2021-21702, CVE-2015-6838, CVE-2019-19204, CVE-2016-6297, and 60 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for gd fixes the following security issues :

  - CVE-2016-7568: A specially crafted image file could     cause an application crash or potentially execute     arbitrary code when the image is converted to webp     (bsc#1001900)

  - CVE-2016-8670: Stack Buffer Overflow in GD dynamicGetbuf     (bsc#1004924)

  - CVE-2016-6911: Check for out-of-bound read in     dynamicGetbuf() (bsc#1005274)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3117-1 advisory.

    Ibrahim El-Sayed discovered that the GD library incorrectly handled certain malformed Tiff images. If a     user or automated system were tricked into processing a specially crafted Tiff image, an attacker could     cause a denial of service. (CVE-2016-6911)

    Ke Liu discovered that the GD library incorrectly handled certain integers when processing WebP images. If     a user or automated system were tricked into processing a specially crafted WebP image, an attacker could     cause a denial of service, or possibly execute arbitrary code. This issue only applied to Ubuntu 14.04     LTS, Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-7568)

    Emmanuel Law discovered that the GD library incorrectly handled certain strings when creating images. If a     user or automated system were tricked into processing a specially crafted image, an attacker could cause a     denial of service, or possibly execute arbitrary code. (CVE-2016-8670)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
96026	Fedora 24 : gd (2016-e45a7e7b13)	Nessus	Fedora Local Security Checks	2016/12/20	2026/1/8	critical
96731	macOS 10.12.x < 10.12.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2017/1/24	2026/1/2	critical
94113	Debian DLA-665-1 : libgd2 security update	Nessus	Debian Local Security Checks	2016/10/19	2026/1/21	critical
330497	NewStart CGSL MAIN 6.06 : gd Multiple Vulnerabilities (NS-SA-2026-0053)	Nessus	NewStart CGSL Local Security Checks	2026/7/29	2026/7/29	critical
219795	Linux Distros Unpatched Vulnerability : CVE-2016-8670	Nessus	Misc.	2025/3/4	2026/7/31	critical
355689	CentOS Linux 7.9 [CIQ] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0728)	Nessus	CentOS Local Security Checks	2026/10/1	2026/10/8	critical
94434	SUSE SLED12 / SLES12 Security Update : gd (SUSE-SU-2016:2668-1)	Nessus	SuSE Local Security Checks	2016/10/31	2026/1/20	critical
94466	Ubuntu 14.04 LTS / 16.04 LTS : GD library vulnerabilities (USN-3117-1)	Nessus	Ubuntu Local Security Checks	2016/11/2	2024/8/27	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical