cve/2016/CVE-2016-3074.md

CVE-2016-3074

Description

Integer signedness error in GD Graphics Library 2.1.1 (aka libgd or libgd2) allows remote attackers to cause a denial of service (crash) or potentially execute arbitrary code via crafted compressed gd2 data, which triggers a heap-based buffer overflow.

POC

Reference

• http://packetstormsecurity.com/files/136757/libgd-2.1.1-Signedness.html
• http://seclists.org/fulldisclosure/2016/Apr/72
• https://www.exploit-db.com/exploits/39736/

Github

• https://github.com/ARPSyndicate/cvemon