In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() function, the read outside allocated buffer will be used. This can lead to crashes or disclosure of confidential information.
References
| Link | Resource |
|---|---|
| https://bugs.php.net/bug.php?id=81739 | Exploit Issue Tracking Patch Vendor Advisory |
| https://bugs.php.net/bug.php?id=81739 | Exploit Issue Tracking Patch Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 07:04
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| References | () https://bugs.php.net/bug.php?id=81739 - Exploit, Issue Tracking, Patch, Vendor Advisory |
02 Apr 2024, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() function, the read outside allocated buffer will be used. This can lead to crashes or disclosure of confidential information. |
07 Nov 2023, 03:47
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | In PHP versions prior to 7.4.33, 8.0.25 and 8.2.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() function, the read outside allocated buffer will be used. This can lead to crashes or disclosure of confidential information. |
Information
Published : 2022-11-14 07:15
Updated : 2024-11-21 07:04
NVD link : CVE-2022-31630
Mitre link : CVE-2022-31630
CVE.ORG link : CVE-2022-31630
JSON object : View
Products Affected
php
- php