blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2017-7890

MEDIUM 6.5 CVSS 3.0
Published
August 2, 2017
Last modified
June 17, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-200
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Description

The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.31 and 7.x before 7.1.7, does not zero colorMap arrays before use. A specially crafted GIF image could use the uninitialized tables to read ~700 bytes from the top of the stack, potentially disclosing sensitive information.

Affected products and versions

  • PHP — Up to and including 5.6.30
  • PHP versions 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.12, 7.0.13, 7.0.14, 7.0.15, 7.0.16, 7.0.17, 7.0.18, 7.0.19, 7.0.20, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6

References

  • php.net http://php.net/ChangeLog-5.php Release Notes, Vendor Advisory
  • php.net http://php.net/ChangeLog-7.php Release Notes, Vendor Advisory
  • www.debian.org http://www.debian.org/security/2017/dsa-3938
  • www.securityfocus.com http://www.securityfocus.com/bid/99492 Third Party Advisory, VDB Entry
  • access.redhat.com https://access.redhat.com/errata/RHSA-2018:0406
  • access.redhat.com https://access.redhat.com/errata/RHSA-2018:1296
  • bugs.php.net https://bugs.php.net/bug.php?id=74435 Patch, Vendor Advisory
  • bugs.php.net https://bugs.php.net/patch-display.php?bug=74435&patch=fix-74435-php-7.0&revision=1497970038 Issue Tracking, Patch, Vendor Advisory
  • security.netapp.com https://security.netapp.com/advisory/ntap-20180112-0001/
  • www.tenable.com https://www.tenable.com/security/tns-2017-12
  • nvd.nist.gov Official NVD record