CVE-2016-6912

Name	CVE-2016-6912
Description	Double free vulnerability in the gdImageWebPtr function in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via large width and height values.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
References	DSA-3777-1
NVD severity	high

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libgd2 (PTS)	stretch	2.2.4-2+deb9u5	fixed
	stretch (security)	2.2.4-2+deb9u4	fixed
	buster	2.2.5-5.2	fixed
	bookworm, bullseye, sid	2.3.0-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
libgd2	source	wheezy	(not affected)
libgd2	source	jessie	2.1.0-5+deb8u9	DSA-3777-1
libgd2	source	(unstable)	2.2.4-1

[wheezy] - libgd2 <not-affected> (Vulnerable code introduced later)
https://github.com/libgd/libgd/commit/a49feeae76d41959d85ee733925a4cf40bac61b2