gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch function in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1, has a heap-based buffer overflow. This can be exploited by an attacker who is able to trigger imagecolormatch calls with crafted image data.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade gd-develUpgrade gd | May 4, 2022 | Jan 27, 2019 |
| Alpine Linux | — | Upgrade php7Upgrade gd | Apr 16, 2019 | Jan 27, 2019 |
| Centos_linux | — | Upgrade gd-develUpgrade gd-debugsourceUpgrade gd-debuginfoUpgrade gdUpgrade gd-progs-debuginfo | Nov 5, 2020 | Jan 27, 2019 |
| Debian | — | Upgrade libgd2 | Feb 6, 2019 | Jan 26, 2019 |
| Gentoo Linux | — | Upgrade media-libs/gd. | Mar 29, 2019 | Jan 26, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade php-recodeUpgrade php-xmlrpcUpgrade phpUpgrade php-commonUpgrade php-ldapUpgrade php-mysqlUpgrade php-odbcUpgrade php-pgsqlUpgrade php-pdoUpgrade php-soapUpgrade php-processUpgrade php-cliUpgrade php-xmlUpgrade php-gd | Mar 27, 2019 | Jan 26, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade php-processUpgrade php-mysqlUpgrade php-xmlrpcUpgrade php-cliUpgrade php-commonUpgrade php-pgsqlUpgrade php-gdUpgrade php-recodeUpgrade php-pdoUpgrade phpUpgrade php-soapUpgrade php-xmlUpgrade php-ldapUpgrade php-odbc | Mar 11, 2019 | Jan 26, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade gd | Jun 27, 2019 | Jan 27, 2019 |
| Oracle Solaris | — | Upgrade web/php-73 to version 7.3.9-11.4.15.0.1.1.0 on Solaris 11.4Upgrade library/gd to version 2.2.5-11.4.21.0.1.69.0 on Solaris 11.4Upgrade web/php-71 to version 7.1.32-11.4.15.0.1.1.0 on Solaris 11.4 | Nov 20, 2019 | Jan 27, 2019 |
| Oracle_linux | — | Upgrade gd-develUpgrade gd | Nov 12, 2020 | Dec 9, 2018 |
| Php | — | Upgrade to PHP version 7.2.14Upgrade to PHP version 7.3.1Upgrade to PHP version 5.6.40 | Feb 11, 2019 | Jan 26, 2019 |
| Redhat_linux | — | Upgrade gdUpgrade gd-debuginfoUpgrade gd-progs-debuginfoUpgrade gd-develUpgrade gd-debugsourceNo solution exists | Nov 5, 2020 | Jan 27, 2019 |
| Rocky_linux | — | Upgrade gd-develUpgrade gd-debugsourceUpgrade gdUpgrade gd-debuginfo | Mar 12, 2024 | Jan 27, 2019 |
| Suse | — | Upgrade php7-mysqlUpgrade php5-enchantUpgrade php53-sysvmsgUpgrade php7-xmlwriterUpgrade php5-fileinfoUpgrade php5-jsonUpgrade php5-wddxUpgrade php53-develUpgrade php53-wddxUpgrade php5-pharUpgrade php7-pspellUpgrade php7-pharUpgrade php53-bz2Upgrade php7-zipUpgrade php5-xmlwriterUpgrade php7-soapUpgrade php53-ftpUpgrade php53-fastcgiUpgrade php5-pgsqlUpgrade libgd3-32bitUpgrade php53-gmpUpgrade php53-suhosinUpgrade php5-pdoUpgrade php7-intlUpgrade php7-ctypeUpgrade php53-mcryptUpgrade php5-pcntlUpgrade php5-opcacheUpgrade php5-dbaUpgrade php53-bcmathUpgrade php7-pcntlUpgrade php7-ftpUpgrade php7-xmlreaderUpgrade php7-snmpUpgrade php53-socketsUpgrade php5-imapUpgrade php5-mysqlUpgrade php5-tokenizerUpgrade php5-zipUpgrade php53-mbstringUpgrade php7-tokenizerUpgrade php7-sysvsemUpgrade php53-mysqlUpgrade php7-enchantUpgrade php53-gettextUpgrade php5-calendarUpgrade php53-xmlrpcUpgrade php5-gettextUpgrade php53-pearUpgrade php5-bcmathUpgrade apache2-mod_php5Upgrade php5-sysvshmUpgrade php53-dbaUpgrade php5-develUpgrade php53-domUpgrade php5-suhosinUpgrade php5-posixUpgrade php53-curlUpgrade libgd3Upgrade php5-intlUpgrade php7-wddxUpgrade php7-iconvUpgrade php7-gdUpgrade php7-pdoUpgrade php7-curlUpgrade php7-posixUpgrade php7-bcmathUpgrade php7-socketsUpgrade php7-fastcgiUpgrade php7-pearUpgrade php5-pspellUpgrade php53-jsonUpgrade php5-sysvsemUpgrade php53-ldapUpgrade php7-opcacheUpgrade php5-gdUpgrade php53-tidyUpgrade php7-pgsqlUpgrade php5Upgrade php53-pgsqlUpgrade php53-pspellUpgrade php53Upgrade php5-iconvUpgrade php7-gmpUpgrade php5-opensslUpgrade apache2-mod_php53Upgrade php53-sqliteUpgrade php53-zlibUpgrade php7-xslUpgrade php7-zlibUpgrade php53-gdUpgrade php5-domUpgrade php53-snmpUpgrade php5-shmopUpgrade php5-mbstringUpgrade php7-gettextUpgrade php5-soapUpgrade php7-sqliteUpgrade php7-bz2Upgrade php53-xmlreaderUpgrade php5-sqliteUpgrade php5-curlUpgrade php7-domUpgrade php5-ftpUpgrade php5-mcryptUpgrade php5-fastcgiUpgrade gd-32bitUpgrade gdUpgrade apache2-mod_php7Upgrade php5-xmlrpcUpgrade gd-develUpgrade php7-jsonUpgrade php53-xmlwriterUpgrade php53-sysvshmUpgrade php53-shmopUpgrade php53-pdoUpgrade php53-calendarUpgrade php53-intlUpgrade php7-sysvshmUpgrade php7-opensslUpgrade php5-xslUpgrade php53-readlineUpgrade php5-odbcUpgrade php7-fileinfoUpgrade php5-bz2Upgrade php5-zlibUpgrade php53-opensslUpgrade php5-sysvmsgUpgrade php7-dbaUpgrade php53-fileinfoUpgrade php7-exifUpgrade php53-imapUpgrade php7-ldapUpgrade php7-xmlrpcUpgrade php7-shmopUpgrade php5-exifUpgrade php7-odbcUpgrade php53-odbcUpgrade php7-sysvmsgUpgrade php53-xslUpgrade php53-iconvUpgrade php7-mbstringUpgrade php53-tokenizerUpgrade php53-posixUpgrade php53-exifUpgrade php7-mcryptUpgrade php53-sysvsemUpgrade php7-fpmUpgrade php7Upgrade php53-soapUpgrade php5-ldapUpgrade php5-snmpUpgrade php5-ctypeUpgrade php5-pearUpgrade php7-pear-archive_tarUpgrade php7-develUpgrade php7-calendarUpgrade php5-xmlreaderUpgrade php53-zipUpgrade php53-pcntlUpgrade php5-socketsUpgrade php5-fpmUpgrade php5-gmpUpgrade php53-ctypeUpgrade php7-imap | Feb 13, 2019 | Jan 26, 2019 |
| Ubuntu | — | Upgrade libgd3Upgrade libgd-tools | Mar 13, 2019 | Jan 26, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jan 27, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub