Home

CVE-2009-3546

Description

The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.x before 5.3.1, and the GD Graphics Library 2.x, does not properly verify a certain colorsTotal structure member, which might allow remote attackers to conduct buffer overflow or buffer over-read attacks via a crafted GD file, a different vulnerability than CVE-2009-3293. NOTE: some of these details are obtained from third party information.

Risk Information

Base Score
9.8
MODERATE
Vector
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
Exploitation Probability
4.125

Associated Vulnerability

VulnerabilityOS Platform
(RHSA-2010:0003) Moderate: gd security update gd-2.0.33-9.4.el5_4.2.i386.rpmLinux
(RHSA-2010:0003) Moderate: gd security update gd-2.0.33-9.4.el5_4.2.x86_64.rpmLinux
(RHSA-2010:0003) Moderate: gd security update gd-devel-2.0.33-9.4.el5_4.2.i386.rpmLinux
(RHSA-2010:0003) Moderate: gd security update gd-devel-2.0.33-9.4.el5_4.2.x86_64.rpmLinux
(RHSA-2010:0003) Moderate: gd security update gd-progs-2.0.33-9.4.el5_4.2.i386.rpmLinux
(RHSA-2010:0003) Moderate: gd security update gd-progs-2.0.33-9.4.el5_4.2.x86_64.rpmLinux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234