blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2018-5711

MEDIUM 5.5 CVSS 3.0
Published
January 16, 2018
Last modified
June 17, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-681, CWE-835
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Description

gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1, has an integer signedness error that leads to an infinite loop via a crafted GIF file, as demonstrated by a call to the imagecreatefromgif or imagecreatefromstring PHP function. This is related to GetCode_ and gdImageCreateFromGifCtx.

Affected products and versions

  • PHP — Up to and including 5.6.32
  • PHP — From 7.0.0 (including) to 7.0.26 (including)
  • PHP — From 7.1.0 (excluding) to 7.1.12 (including)
  • PHP versions 7.2.0

References

  • php.net http://php.net/ChangeLog-5.php Release Notes, Vendor Advisory
  • php.net http://php.net/ChangeLog-7.php Release Notes, Vendor Advisory
  • access.redhat.com https://access.redhat.com/errata/RHSA-2018:1296 Third Party Advisory
  • access.redhat.com https://access.redhat.com/errata/RHSA-2019:2519
  • bugs.php.net https://bugs.php.net/bug.php?id=75571 Patch, Vendor Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2018/01/msg00022.html Third Party Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2019/01/msg00028.html Third Party Advisory
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3CZ2QADQTKRHTGB2AHD7J4QQNDLBEMM6/
  • security.gentoo.org https://security.gentoo.org/glsa/201903-18 Third Party Advisory
  • usn.ubuntu.com https://usn.ubuntu.com/3755-1/ Third Party Advisory
  • www.oracle.com https://www.oracle.com/security-alerts/cpuapr2020.html
  • nvd.nist.gov Official NVD record