Bug 1022263 (CVE-2016-10166)

Summary:	VUL-1: CVE-2016-10166: gd,php5,php53,php7: potential unsigned underflow
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Andreas Stieger <astieger>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	meissner, mikhail.kasimov, pgajdos
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
Whiteboard:	CVSSv2:SUSE:CVE-2016-10166:4.4:(AV:L/AC:M/Au:N/C:P/I:P/A:P) maint:released:oes11-sp2:63399 CVSSv2:NVD:CVE-2016-10166:7.5:(AV:N/AC:L/Au:N/C:P/I:P/A:P) CVSSv3:RedHat:CVE-2016-10166:4.8:(AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---
Bug Depends on:	1022069
Bug Blocks:

Description Andreas Stieger 2017-01-27 12:56:41 UTC

+++ This bug was initially created as a clone of Bug #1022069 +++

Ref: http://seclists.org/oss-sec/2017/q1/202
===============================================

1/ Fix potential unsigned underflow
Commit: https://github.com/libgd/libgd/commit/60bfb401ad5a4a8ae995dcd36372fe15c71e1a35

Comment 1 Swamp Workflow Management 2017-01-27 23:01:11 UTC

bugbot adjusting priority

Comment 2 Andreas Stieger 2017-01-30 12:29:12 UTC

SUSE:SLE-12:Update/gd
SUSE:SLE-12:Update/php5
SUSE:SLE-12:Update/php7

Comment 3 Petr Gajdos 2017-01-31 14:59:16 UTC

Looking at

https://github.com/libgd/libgd/commit/60bfb401ad5a4a8ae995dcd36372fe15c71e1a35

there are two parts:

(1) "No need to decrease `u`, so we don't do it."

(2) ".. factor out the overflow check of the loop, what improves performance and readability."

Second one does not look like a security issue.

Comment 4 Petr Gajdos 2017-01-31 15:22:51 UTC

(In reply to Petr Gajdos from comment #3)
> https://github.com/libgd/libgd/commit/
> 60bfb401ad5a4a8ae995dcd36372fe15c71e1a35
> 
> there are two parts:
> 
> (1) "No need to decrease `u`, so we don't do it."

This is not part of php master, I will notify php upstream.

Comment 6 Petr Gajdos 2017-02-01 14:55:37 UTC

I believe all fixed.

Comment 8 Swamp Workflow Management 2017-02-15 11:10:01 UTC

SUSE-SU-2017:0468-1: An update that fixes 6 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1022263,1022264,1022265,1022283,1022284,1022553
CVE References: CVE-2016-10166,CVE-2016-10167,CVE-2016-10168,CVE-2016-6906,CVE-2016-6912,CVE-2016-9317
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP2 (src):    gd-2.1.0-23.1
SUSE Linux Enterprise Workstation Extension 12-SP1 (src):    gd-2.1.0-23.1
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    gd-2.1.0-23.1
SUSE Linux Enterprise Software Development Kit 12-SP1 (src):    gd-2.1.0-23.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    gd-2.1.0-23.1
SUSE Linux Enterprise Server 12-SP2 (src):    gd-2.1.0-23.1
SUSE Linux Enterprise Server 12-SP1 (src):    gd-2.1.0-23.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    gd-2.1.0-23.1
SUSE Linux Enterprise Desktop 12-SP1 (src):    gd-2.1.0-23.1

Comment 10 Swamp Workflow Management 2017-02-22 14:10:06 UTC

SUSE-SU-2017:0534-1: An update that fixes 13 vulnerabilities is now available.

Category: security (important)
Bug References: 1008026,1019547,1019550,1019568,1019570,1022219,1022255,1022257,1022260,1022262,1022263,1022264,1022265
CVE References: CVE-2016-10158,CVE-2016-10159,CVE-2016-10160,CVE-2016-10161,CVE-2016-10162,CVE-2016-10166,CVE-2016-10167,CVE-2016-10168,CVE-2016-7478,CVE-2016-7479,CVE-2016-7480,CVE-2016-9138,CVE-2017-5340
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    php7-7.0.7-35.1
SUSE Linux Enterprise Software Development Kit 12-SP1 (src):    php7-7.0.7-35.1
SUSE Linux Enterprise Module for Web Scripting 12 (src):    php7-7.0.7-35.1

Comment 11 Swamp Workflow Management 2017-02-22 20:31:57 UTC

openSUSE-SU-2017:0548-1: An update that fixes 6 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1022263,1022264,1022265,1022283,1022284,1022553
CVE References: CVE-2016-10166,CVE-2016-10167,CVE-2016-10168,CVE-2016-6906,CVE-2016-6912,CVE-2016-9317
Sources used:
openSUSE Leap 42.2 (src):    gd-2.1.0-16.1
openSUSE Leap 42.1 (src):    gd-2.1.0-19.1

Comment 12 Swamp Workflow Management 2017-02-23 14:09:14 UTC

SUSE-SU-2017:0556-1: An update that fixes 8 vulnerabilities is now available.

Category: security (important)
Bug References: 1019550,1022219,1022255,1022257,1022260,1022263,1022264,1022265
CVE References: CVE-2016-10158,CVE-2016-10159,CVE-2016-10160,CVE-2016-10161,CVE-2016-10166,CVE-2016-10167,CVE-2016-10168,CVE-2016-7478
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    php5-5.5.14-96.1
SUSE Linux Enterprise Software Development Kit 12-SP1 (src):    php5-5.5.14-96.1
SUSE Linux Enterprise Module for Web Scripting 12 (src):    php5-5.5.14-96.1

Comment 13 Swamp Workflow Management 2017-02-27 17:09:48 UTC

SUSE-SU-2017:0568-1: An update that fixes 8 vulnerabilities is now available.

Category: security (important)
Bug References: 1019550,1022219,1022255,1022257,1022260,1022263,1022264,1022265
CVE References: CVE-2016-10158,CVE-2016-10159,CVE-2016-10160,CVE-2016-10161,CVE-2016-10166,CVE-2016-10167,CVE-2016-10168,CVE-2016-7478
Sources used:
SUSE OpenStack Cloud 5 (src):    php53-5.3.17-101.1
SUSE Manager Proxy 2.1 (src):    php53-5.3.17-101.1
SUSE Manager 2.1 (src):    php53-5.3.17-101.1
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    php53-5.3.17-101.1
SUSE Linux Enterprise Server 11-SP4 (src):    php53-5.3.17-101.1
SUSE Linux Enterprise Server 11-SP3-LTSS (src):    php53-5.3.17-101.1
SUSE Linux Enterprise Point of Sale 11-SP3 (src):    php53-5.3.17-101.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    php53-5.3.17-101.1
SUSE Linux Enterprise Debuginfo 11-SP3 (src):    php53-5.3.17-101.1

Comment 14 Swamp Workflow Management 2017-03-02 14:13:55 UTC

openSUSE-SU-2017:0588-1: An update that fixes 13 vulnerabilities is now available.

Category: security (important)
Bug References: 1008026,1019547,1019550,1019568,1019570,1022219,1022255,1022257,1022260,1022262,1022263,1022264,1022265
CVE References: CVE-2016-10158,CVE-2016-10159,CVE-2016-10160,CVE-2016-10161,CVE-2016-10162,CVE-2016-10166,CVE-2016-10167,CVE-2016-10168,CVE-2016-7478,CVE-2016-7479,CVE-2016-7480,CVE-2016-9138,CVE-2017-5340
Sources used:
openSUSE Leap 42.2 (src):    php7-7.0.7-12.1

Comment 15 Matthias Gerstner 2017-03-06 10:19:12 UTC

All affected codestreams released. openSUSE comes from SLE. Closing.

Comment 16 Bernhard Wiedemann 2017-07-17 10:00:32 UTC

This is an autogenerated message for OBS integration:
This bug (1022263) was mentioned in
https://build.opensuse.org/request/show/510888 Factory / gd