6.8
CVSSv2

CVE-2013-7226

Published: 18/02/2014 Updated: 29/08/2017
CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6
VMScore: 605
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Summary

Integer overflow in the gdImageCrop function in ext/gd/gd.c in PHP 5.5.x prior to 5.5.9 allows remote malicious users to cause a denial of service (application crash) or possibly have unspecified other impact via an imagecrop function call with a large x dimension value, leading to a heap-based buffer overflow.

Vendor Advisories

Integer overflow in the gdImageCrop function in ext/gd/gdc in PHP 55x before 559 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an imagecrop function call with a large x dimension value, leading to a heap-based buffer overflow ...
Several security issues were fixed in PHP ...

Github Repositories

This repo records all the vulnerabilities of linux software I have reproduced in my local workspace

LinuxFlaw This repo records all the vulnerabilities of linux software I have reproduced in my local workspace If the vulnerability has both CVE-ID and EDB-ID, CVE-ID is preferred as its directory name All the vulnerable source code packages are stored in source-packages Vmware Workstation Images Image Name username password Ubuntu 810 exploit exploit Ubuntu 1004LTS

Recent Articles

Quick PHP patch beats slow research reveal
The Register • Darren Pauli • 23 Oct 2014

Simple solution to remote code execution

Patches have been flung out to cover vulnerabilities in PHP that led to remote code execution and buffer overflows.
The flaws were detailed this week by Swiss researchers High-Tech Bridge in versions 5.4.33, 5.5.17 and 5.6.1 on a machine running Ubuntu 14.04.1 LTS and the Radamsa fuzzer.
A patch issued last month for CVE-2014-3669 closed an unserialised function which researcher Symeon Paraschoudis detailed in a technical walk through.
"As expected *p pointer (stored in edx) no...