CVE-2018-5711

Description

gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1, has an integer signedness error that leads to an infinite loop via a crafted GIF file, as demonstrated by a call to the imagecreatefromgif or imagecreatefromstring PHP function. This is related to GetCode_ and gdImageCreateFromGifCtx.

Risk Information

Base Score

5.5

MODERATE

Vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS Score

Exploitation Probability

10.523

Associated Vulnerability

Vulnerability	OS Platform
SUSE-SU-2018:0235-1(SUSE Linux Enterprise Server 11-SP4 ) gd-2.0.36.RC1-52.33.5.1.x86_64.rpm	Linux
SUSE-SU-2018:0260-1(SUSE Linux Enterprise Desktop 12-SP2 ) gd-2.1.0-24.6.1.x86_64.rpm	Linux
SUSE-SU-2018:0260-1(SUSE Linux Enterprise Desktop 12-SP2 ) gd-32bit-2.1.0-24.6.1.x86_64.rpm	Linux
SUSE-SU-2018:0260-1(SUSE Linux Enterprise Desktop 12-SP2 ) gd-debuginfo-2.1.0-24.6.1.x86_64.rpm	Linux
SUSE-SU-2018:0260-1(SUSE Linux Enterprise Desktop 12-SP2 ) gd-debuginfo-32bit-2.1.0-24.6.1.x86_64.rpm	Linux
SUSE-SU-2018:0260-1(SUSE Linux Enterprise Desktop 12-SP2 ) gd-debugsource-2.1.0-24.6.1.x86_64.rpm	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234