PHP 'ext/gd/gd.c' Heap Based Buffer Overflow Vulnerability
BID:65533
Info
PHP 'ext/gd/gd.c' Heap Based Buffer Overflow Vulnerability
| Bugtraq ID: | 65533 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2013-7226 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 12 2014 12:00AM |
| Updated: | Sep 01 2014 12:13AM |
| Credit: | kuba |
| Vulnerable: |
Ubuntu Ubuntu Linux 10.04 LTS Gentoo Linux |
| Not Vulnerable: | |
Discussion
PHP 'ext/gd/gd.c' Heap Based Buffer Overflow Vulnerability
PHP is prone to a remote heap-based buffer-overflow because it fails to adequately bounds-check user-supplied data before copying it into an insufficiently sized buffer.
Attackers can exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will result in denial-of-service conditions.
PHP versions 5.5.0 through 5.5.8 are vulnerable.
PHP is prone to a remote heap-based buffer-overflow because it fails to adequately bounds-check user-supplied data before copying it into an insufficiently sized buffer.
Attackers can exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will result in denial-of-service conditions.
PHP versions 5.5.0 through 5.5.8 are vulnerable.
Exploit / POC
PHP 'ext/gd/gd.c' Heap Based Buffer Overflow Vulnerability
The researcher who discovered this issue has created a proof-of-concept. Please see the references for more information.
The researcher who discovered this issue has created a proof-of-concept. Please see the references for more information.
Solution / Fix
PHP 'ext/gd/gd.c' Heap Based Buffer Overflow Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.