CVE-2016-7127

The imagegammacorrect function in ext/gd/gd.c in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate gamma values, which allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact by providing different signs for the second and third arguments.

References

Affected packages

Git / github.com/php/php-src

Affected ranges

Type

GIT

Repo

https://github.com/php/php-src

Events

Introduced

Last Affected

38980c9ea4156ce52a53f9f3e1007ea3d787fa11

Introduced

60fffd296abce5fc071f3c173c25a2696cf683c6

Last Affected

9d582eba7448f1495fae62b13d95d2844ce6b28a

Fixed

1bd103df00f49cf4d4ade2cfe3f456ac058a4eae

Database specific

Show details

{
    "cpe":  [
        "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.0.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.0.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.0.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.0.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.0.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.0.5:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.0.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.0.7:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.0.8:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.0.9:*:*:*:*:*:*:*"
    ],
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "5.6.24"
        },
        {
            "introduced":  "7.0.0"
        },
        {
            "last_affected":  "7.0.0"
        },
        {
            "introduced":  "7.0.1"
        },
        {
            "last_affected":  "7.0.1"
        },
        {
            "introduced":  "7.0.2"
        },
        {
            "last_affected":  "7.0.2"
        },
        {
            "introduced":  "7.0.3"
        },
        {
            "last_affected":  "7.0.3"
        },
        {
            "introduced":  "7.0.4"
        },
        {
            "last_affected":  "7.0.4"
        },
        {
            "introduced":  "7.0.5"
        },
        {
            "last_affected":  "7.0.5"
        },
        {
            "introduced":  "7.0.6"
        },
        {
            "last_affected":  "7.0.6"
        },
        {
            "introduced":  "7.0.7"
        },
        {
            "last_affected":  "7.0.7"
        },
        {
            "introduced":  "7.0.8"
        },
        {
            "last_affected":  "7.0.8"
        },
        {
            "introduced":  "7.0.9"
        },
        {
            "last_affected":  "7.0.9"
        }
    ],
    "source":  [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

7.*

7.0.0

7.0.1

7.0.2

7.0.3

7.0.4

7.0.5

7.0.6

7.0.7

7.0.8

7.0.9

Other

POST_64BIT_BRANCH_MERGE

POST_AST_MERGE

POST_PHP7_NSAPI_REMOVAL

POST_PHP7_REMOVALS

POST_PHPNG_MERGE

PRE_64BIT_BRANCH_MERGE

PRE_AST_MERGE

PRE_PHP7_EREG_MYSQL_REMOVALS

PRE_PHP7_NSAPI_REMOVAL

PRE_PHP7_REMOVALS

php-5.*

php-5.6.24

php-5.6.24RC1

php-7.*

php-7.0.9

php-7.0.9RC1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-7127.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "13061000410432496893915167939260265663",
                "16449094754789311592583499708074726003",
                "249040513906500853715332747983958150376"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2016-7127-b20a7f9e",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/php/php-src/commit/1bd103df00f49cf4d4ade2cfe3f456ac058a4eae",
        "target":  {
            "file":  "ext/gd/gd.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "182819258980180063651267922896273285635",
            "length":  1319
        },
        "id":  "CVE-2016-7127-c5e74e49",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/php/php-src/commit/1bd103df00f49cf4d4ade2cfe3f456ac058a4eae",
        "target":  {
            "file":  "ext/gd/gd.c",
            "function":  "PHP_FUNCTION"
        }
    }
]

vanir_signatures_modified

"2026-08-07T14:49:14Z"