Published: 21/03/2014 Updated: 28/09/2022

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P

The gdImageCreateFromXpm function in gdxpm.c in libgd, as used in PHP 5.4.26 and previous versions, allows remote malicious users to cause a denial of service (NULL pointer dereference and application crash) via a crafted color table in an XPM file.

Vulnerable Product	Search on Vulmon	Subscribe to Product
php php
canonical ubuntu linux 15.10
canonical ubuntu linux 14.04
canonical ubuntu linux 16.04
canonical ubuntu linux 12.04
suse linux enterprise server 11
suse linux enterprise software development kit 11
redhat enterprise linux desktop 7.0
redhat enterprise linux workstation 7.0
redhat enterprise linux server 7.0
redhat enterprise linux server aus 6.5
redhat enterprise linux server tus 6.5
redhat enterprise linux desktop 6.0
redhat enterprise linux server 6.0
redhat enterprise linux workstation 6.0
redhat enterprise linux server tus 7.3
redhat enterprise linux eus 6.5
redhat enterprise linux eus 7.3
redhat enterprise linux eus 7.4
redhat enterprise linux eus 7.5
redhat enterprise linux eus 7.6
redhat enterprise linux eus 7.7
redhat enterprise linux server aus 7.6
redhat enterprise linux server aus 7.3
redhat enterprise linux server tus 7.6
redhat enterprise linux server tus 7.7
debian debian linux 8.0
debian debian linux 7.0
oracle solaris 11.2

Debian Bug report logs - #744719 libgd2: CVE-2014-2497 Package: src:libgd2; Maintainer for src:libgd2 is GD Team <team+gd@trackerdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sun, 13 Apr 2014 20:30:02 UTC Severity: important Tags: security, upstream Found in version libgd2/2036~rc1~dfsg ...

The GD library could be made to crash or run programs if it processed a specially crafted image file ...

Multiple vulnerabilities were discovered in libgd2, a graphics library: CVE-2014-2497 The gdImageCreateFromXpm() function would try to dereference a NULL pointer when reading an XPM file with a special color table This could allow remote attackers to cause a denial of service (crash) via crafted XPM files CVE-2014-9709 Import ...

A denial of service flaw was found in the way the File Information (fileinfo) extension parsed certain Composite Document Format (CDF) files A remote attacker could use this flaw to crash a PHP application using fileinfo via a specially crafted CDF file gd_ctxc in the GD component in PHP 54x before 5432 and 55x before 5516 does not ensu ...

CWE-476 https://bugs.php.net/bug.php?id=66901 https://bugzilla.redhat.com/show_bug.cgi?id=1076676 http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00001.html http://secunia.com/advisories/59652 http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00002.html http://rhn.redhat.com/errata/RHSA-2014-1327.html http://rhn.redhat.com/errata/RHSA-2014-1326.html http://rhn.redhat.com/errata/RHSA-2014-1766.html http://rhn.redhat.com/errata/RHSA-2014-1765.html https://support.apple.com/HT204659 http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html http://www.debian.org/security/2015/dsa-3215 http://www.mandriva.com/security/advisories?name=MDVSA-2015:153 http://advisories.mageia.org/MGASA-2014-0288.html http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html https://security.gentoo.org/glsa/201607-04 http://www.securityfocus.com/bid/66233 http://www.ubuntu.com/usn/USN-2987-1 http://secunia.com/advisories/59496 http://secunia.com/advisories/59418 http://secunia.com/advisories/59061 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=744719 https://usn.ubuntu.com/2987-1/https://nvd.nist.gov

CVE-2014-2497

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect