CVE-2022-31630
OOB read due to insufficient input validation in imageloadfont()
Summary
OOB read due to insufficient input validation in imageloadfont()
Original description
The description as published by the source.
In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() function, the read outside allocated buffer will be used. This can lead to crashes or disclosure of confidential information.
Affected packages
Bitnami
libphp
[{"type":"SEMVER","events":[{"introduced":"7.4.0"},{"fixed":"7.4.33"},{"introduced":"8.0.0"},{"fixed":"8.0.25"},{"introduced":"8.1.0"},{"fixed":"8.1.12"}]}]
Bitnami
php
[{"type":"SEMVER","events":[{"introduced":"7.4.0"},{"fixed":"7.4.33"},{"introduced":"8.0.0"},{"fixed":"8.0.25"},{"introduced":"8.1.0"},{"fixed":"8.1.12"}]}]
Bitnami
php-min
[{"type":"SEMVER","events":[{"introduced":"7.4.0"},{"fixed":"7.4.33"},{"introduced":"8.0.0"},{"fixed":"8.0.25"},{"introduced":"8.1.0"},{"fixed":"8.1.12"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2022-31630 php7.4 Fixed in: 7.4.33-1+deb11u1
References
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- web bugs.php.net