Veracode Vulnerability DatabaseVERACODE:19298Denial Of Service (DoS) Through Memory Corruption
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
PHP is vulnerable to denial of service(DoS) attacks. This occurs in the gdImageFillToBorder function in gd.c in the GD Graphics Library when passing a negative integer as the color parameter. A remote attacker could force a negative color identifier when calling the function which may crash the PHP application, causing a Denial of Service.
| CPE | Name | Operator | Version |
|---|---|---|---|
| rh-php70-php | eq | 7.0.10__2.el7 | |
| rh-php70-php | eq | 7.0.10__2.el6 | |
| rh-php70-php | eq | 7.0.10__2.el7 | |
| rh-php70-php | eq | 7.0.10__2.el6 |
References
lists.opensuse.org/opensuse-updates/2016-12/msg00133.html
lists.opensuse.org/opensuse-updates/2016-12/msg00142.html
lists.opensuse.org/opensuse-updates/2017-01/msg00002.html
lists.opensuse.org/opensuse-updates/2017-01/msg00034.html
lists.opensuse.org/opensuse-updates/2017-01/msg00054.html
www.debian.org/security/2017/dsa-3751
www.openwall.com/lists/oss-security/2016/12/12/2
www.php.net/ChangeLog-5.php
www.php.net/ChangeLog-7.php
www.securityfocus.com/bid/94865
access.redhat.com/documentation/en-us/red_hat_software_collections/3/html/3.1_release_notes/chap-rhscl#sect-RHSCL-Changes-php
access.redhat.com/errata/RHSA-2018:1296
access.redhat.com/security/updates/classification/#moderate
bugs.php.net/bug.php?id=72696
github.com/libgd/libgd/commit/77f619d48259383628c3ec4654b1ad578e9eb40e
github.com/libgd/libgd/issues/215
github.com/php/php-src/commit/863d37ea66d5c960db08d6f4a2cbd2518f0f80d1
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P