CVE-2016-6912

Name	CVE-2016-6912
Description	Double free vulnerability in the gdImageWebPtr function in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via large width and height values.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
References	DSA-3777-1
NVD severity	high (attack range: remote)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libgd2 (PTS)	jessie	2.1.0-5+deb8u11	fixed
	jessie (security)	2.1.0-5+deb8u13	fixed
	stretch (security), stretch	2.2.4-2+deb9u4	fixed
	bullseye, sid, buster	2.2.5-5.2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin
libgd2	source	(unstable)	2.2.4-1	high
libgd2	source	jessie	2.1.0-5+deb8u9	high	DSA-3777-1
libgd2	source	wheezy	(not affected)

[wheezy] - libgd2 <not-affected> (Vulnerable code introduced later)
https://github.com/libgd/libgd/commit/a49feeae76d41959d85ee733925a4cf40bac61b2