PT-2008-6565 · Php+1 · Php+1

Hamid Ebadi · Published 2008-12-26 · Updated 2018-10-30 · CVE-2008-5498

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.2.9

Description The issue is related to an array index error in the imageRotate function, allowing attackers to read the contents of arbitrary memory locations via a crafted value of the bgd color or clrBack argument for an indexed image.

Recommendations For PHP versions prior to 5.2.9, update to a version 5.2.9 or later to resolve the issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2008-5498

HPSBUX02431

HPSBUX02465

RHSA-2009:0337

RHSA-2009:0338

RHSA-2009:0350

RHSA-2009_0337

RHSA-2009_0338

Affected Products

Php

Red Hat

References · 75

• 🔥 http://downloads.securityfocus.com/vulnerabilities/exploits/33002.php · Exploit
• 🔥 https://exploit-db.com/exploits/7646 · Exploit
• 🔥 http://downloads.securityfocus.com/vulnerabilities/exploits/33002-2.php · Exploit
• http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3658 · Security Note
• http://marc.info/?l=bugtraq&m=125631037611762&w=2 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3660 · Security Note
• http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2939 · Security Note
• https://redhat.com/archives/fedora-package-announce/2009-May/msg01465.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2168 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0005 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5557 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2009:022 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5498 · Security Note