CVE-2018-5711

gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1, has an…

published January 16, 2018

CVSS
—
EPSS
13%
Percentile
96.4
In the wild
Unconfirmed
What it is

gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1, has an integer signedness error that leads to an infinite loop via a crafted GIF file, as demonstrated by a call to the imagecreatefromgif or imagecreatefromstring PHP function. This is related to GetCode_ and gdImageCreateFromGifCtx.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.13204 · 96.4th percentile
Published
2018-01-16T09:00Z
EPSS history
Timeline
  • 22 SEP 03:16Z
    EPSS moved 13% → 29%
    epss
  • 06 SEP 03:12Z
    EPSS moved 13% → 29%
    epss
  • 30 AUG 16:01Z
    EPSS moved 29% → 13%
    epss
  • 29 AUG 04:41Z
    EPSS moved 13% → 29%
    epss
  • 16 JAN 09:00Z
    gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1, has an…
    cvelistv5