CVE-2007-4033 Buffer overflow in the intT1_EnvGetCompletePath function in lib/t1lib/t1env.c in t1lib 5.1.1 allows context-dependent attackers to execute arbitrary code via a long FileName parameter. NOTE: this issu...
HighCVSS 7.5
EPSS 18.7%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Buffer overflow in the intT1_EnvGetCompletePath function in lib/t1lib/t1env.c in t1lib 5.1.1 allows context-dependent attackers to execute arbitrary code via a long FileName parameter. NOTE: this issue was originally reported to be in the imagepsloadfont function in php_gd2.dll in the gd (PHP_GD2) extension in PHP 5.2.3.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| PHP | = 5.2.3 | No fix listed |
| t1lib | = 5.1.1 | No fix listed |
References
- bugs.gentoo.org
- FEDORA-2007-2343 vendor-advisory
- 26241 third-party-advisory vendor-advisory
- 26901 third-party-advisory vendor-advisory
- 26981 third-party-advisory vendor-advisory
- 26992 third-party-advisory vendor-advisory
- 27239 third-party-advisory vendor-advisory
- 27297 third-party-advisory
- 27439 third-party-advisory vendor-advisory
- 27599 third-party-advisory vendor-advisory
- 27718 third-party-advisory
- 27743 third-party-advisory vendor-advisory
- 28345 third-party-advisory
- 30168 third-party-advisory
- GLSA-200710-12 vendor-advisory
- GLSA-200711-34 vendor-advisory
- GLSA-200805-13 vendor-advisory
- wiki.rpath.com
- www.bugtraq.ir
- DSA-1390 vendor-advisory
- MDKSA-2007:189 vendor-advisory
- MDKSA-2007:230 vendor-advisory
- SUSE-SR:2007:023 vendor-advisory
- RHSA-2007:1027 vendor-advisory
- RHSA-2007:1030 vendor-advisory
- RHSA-2007:1031 vendor-advisory
- 20070921 Re: [Full-disclosure] [USN-515-1] t1lib vulnerability mailing-list
- 20070921 Re: [USN-515-1] t1lib vulnerability mailing-list
- 20080105 rPSA-2008-0007-1 tetex tetex-afm tetex-dvips tetex-fonts tetex-latex tetex-xdvi mailing-list
- 20080212 FLEA-2008-0006-1 tetex tetex-dvips tetex-fonts mailing-list
- 25079 exploit vdb-entry
- 1018905 vdb-entry
- USN-515-1 vendor-advisory
- bugzilla.redhat.com
- php-imagepsloadfont-bo(35620) vdb-entry
- issues.rpath.com
- oval:org.mitre.oval:def:10557 signature vdb-entry
- 4227 exploit
- FEDORA-2007-3390 vendor-advisory
- FEDORA-2007-750 vendor-advisory