CVE-2022-31630
OOB read due to insufficient input validation in imageloadfont()
Résumé
OOB read due to insufficient input validation in imageloadfont()
Description d'origine
La description telle que publiée par la source (souvent en anglais).
In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() function, the read outside allocated buffer will be used. This can lead to crashes or disclosure of confidential information.
Paquets affectés
Bitnami
libphp
[{"type":"SEMVER","events":[{"introduced":"7.4.0"},{"fixed":"7.4.33"},{"introduced":"8.0.0"},{"fixed":"8.0.25"},{"introduced":"8.1.0"},{"fixed":"8.1.12"}]}]
Bitnami
php
[{"type":"SEMVER","events":[{"introduced":"7.4.0"},{"fixed":"7.4.33"},{"introduced":"8.0.0"},{"fixed":"8.0.25"},{"introduced":"8.1.0"},{"fixed":"8.1.12"}]}]
Bitnami
php-min
[{"type":"SEMVER","events":[{"introduced":"7.4.0"},{"fixed":"7.4.33"},{"introduced":"8.0.0"},{"fixed":"8.0.25"},{"introduced":"8.1.0"},{"fixed":"8.1.12"}]}]
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2022-31630 php7.4 Corrigé dans: 7.4.33-1+deb11u1
Références
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- web bugs.php.net