PT-2019-1693 · Php+8 · Php+8
Cfreal
+1
·
Publicado
2018-12-09
·
Atualizado
2024-06-15
·
CVE-2019-6977
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
The GD Graphics Library versions 2.2.5 and earlier
PHP versions prior to 5.6.40
PHP versions 7.x prior to 7.1.26
PHP versions 7.2.x prior to 7.2.14
PHP versions 7.3.x prior to 7.3.1
Description
The issue is caused by a heap-based buffer overflow in the
gdImageColorMatch function of the GD Graphics Library. This can be exploited by a remote attacker who can trigger imagecolormatch calls with specially crafted image data, potentially allowing the attacker to initiate malicious actions.Recommendations
For The GD Graphics Library version 2.2.5, update to a version later than 2.2.5.
For PHP version 5.6.x, update to version 5.6.40 or later.
For PHP version 7.x, update to version 7.1.26 or later.
For PHP version 7.2.x, update to version 7.2.14 or later.
For PHP version 7.3.x, update to version 7.3.1 or later.
As a temporary workaround, consider restricting the use of the
imagecolormatch function until a patch is available.Exploit
Correção
Buffer Overflow
Memory Corruption
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Almalinux
Centos
Gd Graphics Library
Php
Red Hat
Rocky Linux
Suse
Ubuntu