[Forgot Password]
Login  Register Subscribe

24437

 
 

131815

 
 

116370

 
 

909

 
 

90976

 
 

142

Paid content will be excluded from the download.


Download | Alert*
CVE
view XML view JSON

CVE-2017-7890Date: (C)2017-08-04   (M)2018-09-27


The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.31 and 7.x before 7.1.7, does not zero colorMap arrays before use. A specially crafted GIF image could use the uninitialized tables to read ~700 bytes from the top of the stack, potentially disclosing sensitive information.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V3 Severity:CVSS V2 Severity:
CVSS Score : 6.5CVSS Score : 4.3
Exploit Score: 2.8Exploit Score: 8.6
Impact Score: 3.6Impact Score: 2.9
 
CVSS V3 Metrics:CVSS V2 Metrics:
Attack Vector: NETWORKAccess Vector: NETWORK
Attack Complexity: LOWAccess Complexity: MEDIUM
Privileges Required: NONEAuthentication: NONE
User Interaction: REQUIREDConfidentiality: PARTIAL
Scope: UNCHANGEDIntegrity: NONE
Confidentiality: HIGHAvailability: NONE
Integrity: NONE 
Availability: NONE 
  
Reference:
BID-99492
DSA-3938
RHSA-2018:0406
RHSA-2018:1296
http://php.net/ChangeLog-5.php
http://php.net/ChangeLog-7.php
https://bugs.php.net/bug.php?id=74435
https://bugs.php.net/patch-display.php?bug=74435&patch=fix-74435-php-7.0&revision=1497970038
https://security.netapp.com/advisory/ntap-20180112-0001/
https://www.tenable.com/security/tns-2017-12

CPE    2
cpe:/a:php:php:7.0.0
cpe:/a:php:php:7.0.1
CWE    1
CWE-200
OVAL    12
oval:org.secpod.oval:def:113112
oval:org.secpod.oval:def:1600744
oval:org.secpod.oval:def:113491
oval:org.secpod.oval:def:1800681
...

© SecPod Technologies