php: Buffer over-read from unitialized data in gdImageCreateFromGifCtx function

A data leak was found in gdImageCreateFromGifCtx in GD Graphics Library used in PHP before 5.6.31 and 7.1.7. An attacker could craft a malicious GIF image and read up to 762 bytes from stack...

Medium: php56, php70, php71

Issue Overview: Reflected XSS in .phar 404 page An issue was discovered in PHP; there is Reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file. CVE-2018-5712 Denial of Service DoS via infinite loop in libgd gdImageCreateFromGifCtx function in ext/gd/libgd/gdgifin.c Th...

openSUSE Security Update : gd (openSUSE-2018-109)

This update for gd fixes one issues. This security issue was fixed : - CVE-2018-5711: Prevent integer signedness error that could have lead to an infinite loop via a crafted GIF file allowing for DoS bsc1076391 This update was imported from the SUSE:SLE-12:Update update project. %NASLMINLEVEL 703...

SUSE SLED12 / SLES12 Security Update : gd (SUSE-SU-2018:0260-1)

This update for gd fixes one issues. This security issue was fixed : - CVE-2018-5711: Prevent integer signedness error that could have lead to an infinite loop via a crafted GIF file allowing for DoS bsc1076391 Note that Tenable Network Security has extracted the preceding description block...

SUSE SLES11 Security Update : gd (SUSE-SU-2018:0235-1)

This update for gd fixes several issues. This security issue was fixed : - CVE-2018-5711: Prevent integer signedness error that could have lead to an infinite loop via a crafted GIF file allowing for DoS bsc1076391 The update package also includes non-security fixes. See advisory for details. Not...

openSUSE Security Update : gd (openSUSE-2018-63)

This update for gd fixes one issues. This security issue was fixed : - CVE-2017-6362: Prevent double-free in gdImagePngPtr that potentially allowed for DoS or remote code execution bsc1056993. This update was imported from the SUSE:SLE-12:Update update project. %NASLMINLEVEL 70300 C Tenable Netwo...

PHP < 5.6.33, 7.x < 7.0.27, 7.1.x < 7.1.13, 7.2.x < 7.2.1 Multiple Vulnerabilities - Linux

PHP is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:php:php"; if description...

PHP < 5.6.33, 7.x < 7.0.27, 7.1.x < 7.1.13, 7.2.x < 7.2.1 Multiple Vulnerabilities - Windows

PHP is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:php:php"; if description...

SUSE SLED12 / SLES12 Security Update : gd (SUSE-SU-2018:0135-1)

This update for gd fixes one issues. This security issue was fixed : - CVE-2017-6362: Prevent double-free in gdImagePngPtr that potentially allowed for DoS or remote code execution bsc1056993. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE...

SUSE-SU-2018:0135-1 Security update for gd

This update for gd fixes one issues. This security issue was fixed: - CVE-2017-6362: Prevent double-free in gdImagePngPtr that potentially allowed for DoS or remote code execution bsc1056993...

ALPINE-CVE-2018-5711

gdgifin.c in the GD Graphics Library aka libgd, as used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1, has an integer signedness error that leads to an infinite loop via a crafted GIF file, as demonstrated by a call to the imagecreatefromgif or...

Integer overflow

gdgifin.c in the GD Graphics Library aka libgd, as used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1, has an integer signedness error that leads to an infinite loop via a crafted GIF file, as demonstrated by a call to the imagecreatefromgif or...

DEBIAN-CVE-2018-5711

gdgifin.c in the GD Graphics Library aka libgd, as used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1, has an integer signedness error that leads to an infinite loop via a crafted GIF file, as demonstrated by a call to the imagecreatefromgif or...

CVE-2018-5711

The vulnerability CVE-2018-5711 affects the GD Graphics Library (libgd2) as used by PHP. Affected GIF parsing code in gd_gif_in.c suffers an integer signedness error that can cause an infinite loop when processing crafted GIF data via imagecreatefromgif or imagecreatefromstring, potentially leadi...

CVE-2018-5711

gdgifin.c in the GD Graphics Library aka libgd, as used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1, has an integer signedness error that leads to an infinite loop via a crafted GIF file, as demonstrated by a call to the imagecreatefromgif or...

PHP 7.0.x < 7.0.27 Multiple Vulnerabilities

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.27. It is, therefore, affected by the following vulnerabilities : - A denial of service DoS vulnerability exists in the imagecreatefromgif and imagecreatefromstring functions of the gdgifin.c script...

PHP 7.2.x < 7.2.1 Multiple Vulnerabilities

According to its banner, the version of PHP running on the remote web server is 7.2.x prior to 7.2.1. It is, therefore, affected by the following vulnerabilities : - A denial of service DoS vulnerability exists in the imagecreatefromgif and imagecreatefromstring functions of the gdgifin.c script...

PHP 7.1.x < 7.1.13 Multiple Vulnerabilities

According to its banner, the version of PHP running on the remote web server is 7.1.x prior to 7.1.13. It is, therefore, affected by the following vulnerabilities : - A denial of service DoS vulnerability exists in the imagecreatefromgif and imagecreatefromstring functions of the gdgifin.c script...

WordPress GD Rating System plugin cross-site scripting vulnerability (CNVD-2018-00916)

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports personal blog sites set up on PHP and MySQL servers.GD Rating System plugin is used in one of the rating plugin. A cross-site scripting vulnerability exists in version...

WordPress GD Rating System plugin directory traversal vulnerability (CNVD-2018-00915)

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports personal blog sites set up on PHP and MySQL servers.GD Rating System plugin is used in one of the rating plugin. A directory traversal vulnerability exists in version...