CVE-2018-5711 gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1, has an integer signedness error that leads to an inf...
MediumCVSS 5.5
EPSS 13.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1, has an integer signedness error that leads to an infinite loop via a crafted GIF file, as demonstrated by a call to the imagecreatefromgif or imagecreatefromstring PHP function. This is related to GetCode_ and gdImageCreateFromGifCtx.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libgd2(Debian:12) | < 2.2.5-4.1 | 2.2.5-4.1 |
| debian/libgd2(Debian:13) | < 2.2.5-4.1 | 2.2.5-4.1 |
| debian/libgd2(Debian:14) | < 2.2.5-4.1 | 2.2.5-4.1 |
| PHP | <= 5.6.32 | No fix listed |
| PHP | >= 7.0.0, <= 7.0.26 | No fix listed |
| PHP | >= 7.1.0, <= 7.1.12 | No fix listed |
| PHP | = 7.2.0 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| Canonical Ubuntu Linux | = 18.04 | No fix listed |
| alpine/gd(Alpine:v3.10) | < 2.2.5-r2 | 2.2.5-r2 |
| alpine/gd(Alpine:v3.11) | < 2.2.5-r2 | 2.2.5-r2 |
| alpine/gd(Alpine:v3.12) | < 2.2.5-r2 | 2.2.5-r2 |
| alpine/gd(Alpine:v3.13) | < 2.2.5-r2 | 2.2.5-r2 |
| alpine/gd(Alpine:v3.14) | < 2.2.5-r2 | 2.2.5-r2 |
| alpine/gd(Alpine:v3.15) | < 2.2.5-r2 | 2.2.5-r2 |
| alpine/gd(Alpine:v3.16) | < 2.2.5-r2 | 2.2.5-r2 |
| alpine/gd(Alpine:v3.17) | < 2.2.5-r2 | 2.2.5-r2 |
| alpine/gd(Alpine:v3.18) | < 2.2.5-r2 | 2.2.5-r2 |
| alpine/gd(Alpine:v3.19) | < 2.2.5-r2 | 2.2.5-r2 |
| alpine/gd(Alpine:v3.20) | < 2.2.5-r2 | 2.2.5-r2 |
| alpine/gd(Alpine:v3.21) | < 2.2.5-r2 | 2.2.5-r2 |
| alpine/gd(Alpine:v3.22) | < 2.2.5-r2 | 2.2.5-r2 |
Show 14 more
| Product | Affected versions | Fixed in |
|---|---|---|
| alpine/gd(Alpine:v3.23) | < 2.2.5-r2 | 2.2.5-r2 |
| alpine/gd(Alpine:v3.24) | < 2.2.5-r2 | 2.2.5-r2 |
| alpine/gd(Alpine:v3.6) | < 2.2.5-r2 | 2.2.5-r2 |
| alpine/gd(Alpine:v3.7) | < 2.2.5-r2 | 2.2.5-r2 |
| alpine/gd(Alpine:v3.8) | < 2.2.5-r2 | 2.2.5-r2 |
| alpine/gd(Alpine:v3.9) | < 2.2.5-r2 | 2.2.5-r2 |
| alpine/php5(Alpine:v3.4) | < 5.6.33-r0 | 5.6.33-r0 |
| alpine/php5(Alpine:v3.5) | < 5.6.33-r0 | 5.6.33-r0 |
| alpine/php5(Alpine:v3.6) | < 5.6.33-r0 | 5.6.33-r0 |
| alpine/php5(Alpine:v3.7) | < 5.6.33-r0 | 5.6.33-r0 |
| alpine/php5(Alpine:v3.8) | < 5.6.33-r0 | 5.6.33-r0 |
| alpine/php7(Alpine:v3.5) | < 7.0.27-r0 | 7.0.27-r0 |
| alpine/php7(Alpine:v3.6) | < 7.1.13-r0 | 7.1.13-r0 |
| alpine/php7(Alpine:v3.7) | < 7.1.13-r0 | 7.1.13-r0 |
References
- Debian Security Tracker CVE-2018-5711 vendor-advisory
- php.net release-notes vendor-advisory
- php.net release-notes vendor-advisory
- RHSA-2018:1296 third-party-advisory vendor-advisory
- RHSA-2019:2519 vendor-advisory
- bugs.php.net patch vendor-advisory
- [debian-lts-announce] 20180119 [SECURITY] [DLA 1248-1] libgd2 security update mailing-list third-party-advisory
- [debian-lts-announce] 20190130 [SECURITY] [DLA 1651-1] libgd2 security update mailing-list third-party-advisory
- FEDORA-2020-e795f92d79 vendor-advisory
- GLSA-201903-18 third-party-advisory vendor-advisory
- USN-3755-1 third-party-advisory vendor-advisory
- www.oracle.com
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking