CVE-2017-7890

The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.31 and 7.x before 7.1.7…

published August 2, 2017

CVSS
—
EPSS
3%
Percentile
88.8
In the wild
Unconfirmed
What it is

The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.31 and 7.x before 7.1.7, does not zero colorMap arrays before use. A specially crafted GIF image could use the uninitialized tables to read ~700 bytes from the top of the stack, potentially disclosing sensitive information.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03418 · 88.8th percentile
Published
2017-08-02T19:00Z
EPSS history
Timeline
  • 02 AUG 19:00Z
    The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.31 and 7.x before 7.1.7…
    cvelistv5