Buffer overflow in the LWZReadByte_ function in ext/gd/libgd/gd_gif_in.c in the GD extension in PHP before 5.1.5 allows remote attackers to have an unknown impact via a GIF file with input_code_size greater than MAX_LWZ_BITS, which triggers an overflow when initializing the table array.
CVSS Details
- CVSS 3.1 Base Score: 3.7
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade libgd2 | Jul 30, 2024 | Aug 31, 2006 |
| Freebsd | — | Upgrade php4-dtcUpgrade mod_php4Upgrade mod_php5Upgrade php4-cgiUpgrade php5-dtcUpgrade php5-nmsUpgrade php5Upgrade php5-cliUpgrade php5-hordeUpgrade php4-hordeUpgrade php5-cgiUpgrade php4-nmsUpgrade php4Upgrade php4-cli | Dec 10, 2025 | Sep 13, 2006 |
| Oracle_linux | — | Upgrade gd-progsUpgrade gd-develUpgrade gd | Oct 16, 2024 | Aug 31, 2006 |
| Php | — | Upgrade to PHP version 5.1.5 | Oct 1, 2012 | Aug 31, 2006 |
| Suse | — | Upgrade perl-Tk-develUpgrade perl-Tk | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libapache2-mod-php4Upgrade php5-curlUpgrade libapache2-mod-php5Upgrade php5-cgiUpgrade php5-cliUpgrade php4-cliUpgrade php4-cgi | Nov 8, 2024 | Aug 31, 2006 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub