PHP CVEs

Description

Multiple integer overflows in the (1) createwbmp and (2) readwbmp functions in wbmp.c in the GD library (libgd) in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allow context-dependent attackers to execute arbitrary code via Wireless Bitmap (WBMP) images with large width or height values.

Affected products and versions

• PHP versions 4.0, 4.0.0, 4.0.1, 4.0.1patch1, 4.0.1patch2, 4.0.2, 4.0.3, 4.0.3patch1, 4.0.4, 4.0.4patch1, 4.0.5, 4.0.6, 4.0.7, 4.0.7rc1, 4.0.7rc2, 4.0.7rc3, 4.0beta1, 4.0beta2, 4.0beta3, 4.0beta4, 4.0beta_4_patch1, 4.0rc1, 4.0rc2, 4.1.0, 4.1.1, 4.1.2, 4.2, 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.3.0, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 4.3.8, 4.3.9, 4.3.10, 4.3.11, 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5, 4.4.6, 5.0.0, 5.0.0beta1, 5.0.0beta2, 5.0.0beta3, 5.0.0beta4, 5.0.0rc1, 5.0.0rc2, 5.0.0rc3, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0rc1, 5.0rc2, 5.0rc3, 5.1.0, 5.1.1, 5.1.2, 5.1.3, 5.1.4, 5.1.5, 5.1.6, 5.2.0, 5.2.1

References

• cvs.php.net http://cvs.php.net/viewvc.cgi/php-src/ext/gd/libgd/wbmp.c?r1=1.2.4.1&r2=1.2.4.1.8.1
• cvs.php.net http://cvs.php.net/viewvc.cgi/php-src/ext/gd/libgd/wbmp.c?revision=1.2.4.1.8.1&view=markup
• docs.info.apple.com http://docs.info.apple.com/article.html?artnum=306172
• ifsec.blogspot.com http://ifsec.blogspot.com/2007/04/php-521-wbmp-file-handling-integer.html
• lists.apple.com http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html
• rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2007-0155.html Vendor Advisory
• secunia.com http://secunia.com/advisories/24814 Vendor Advisory
• secunia.com http://secunia.com/advisories/24909 Vendor Advisory
• secunia.com http://secunia.com/advisories/24924 Vendor Advisory
• secunia.com http://secunia.com/advisories/24945 Vendor Advisory
• secunia.com http://secunia.com/advisories/24965 Vendor Advisory
• secunia.com http://secunia.com/advisories/25056 Vendor Advisory
• secunia.com http://secunia.com/advisories/25151 Vendor Advisory
• secunia.com http://secunia.com/advisories/25445 Vendor Advisory
• secunia.com http://secunia.com/advisories/26235 Vendor Advisory
• security.gentoo.org http://security.gentoo.org/glsa/glsa-200705-19.xml
• us2.php.net http://us2.php.net/releases/4_4_7.php
• us2.php.net http://us2.php.net/releases/5_2_2.php
• www.mandriva.com http://www.mandriva.com/security/advisories?name=MDKSA-2007:087
• www.mandriva.com http://www.mandriva.com/security/advisories?name=MDKSA-2007:088
• www.mandriva.com http://www.mandriva.com/security/advisories?name=MDKSA-2007:089
• www.mandriva.com http://www.mandriva.com/security/advisories?name=MDKSA-2007:090
• www.novell.com http://www.novell.com/linux/security/advisories/2007_32_php.html
• www.redhat.com http://www.redhat.com/support/errata/RHSA-2007-0153.html Vendor Advisory
• www.redhat.com http://www.redhat.com/support/errata/RHSA-2007-0162.html Vendor Advisory
• www.securityfocus.com http://www.securityfocus.com/archive/1/464957/100/0/threaded
• www.securityfocus.com http://www.securityfocus.com/archive/1/466166/100/0/threaded
• www.securityfocus.com http://www.securityfocus.com/bid/23357
• www.securityfocus.com http://www.securityfocus.com/bid/25159
• www.slackware.org http://www.slackware.org/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.470053
• www.vupen.com http://www.vupen.com/english/advisories/2007/1269 Vendor Advisory
• www.vupen.com http://www.vupen.com/english/advisories/2007/2732 Vendor Advisory
• exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/33453
• issues.rpath.com https://issues.rpath.com/browse/RPL-1268
• oval.cisecurity.org https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10179
• nvd.nist.gov Official NVD record