5.5

CVE-2018-5711

gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1, has an integer signedness error that leads to an infinite loop via a crafted GIF file, as demonstrated by a call to the imagecreatefromgif or imagecreatefromstring PHP function. This is related to GetCode_ and gdImageCreateFromGifCtx.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Php ≫ Php Version <= 5.6.32
Php ≫ Php Version >= 7.0.0 <= 7.0.26
Php ≫ Php Version > 7.1.0 <= 7.1.12
Php ≫ Php Version 7.2.0
Debian ≫ Debian Linux Version 7.0
Debian ≫ Debian Linux Version 8.0
Canonical ≫ Ubuntu Linux Version 14.04 SwEdition lts
Canonical ≫ Ubuntu Linux Version 16.04 SwEdition lts
Canonical ≫ Ubuntu Linux Version 18.04 SwEdition lts
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 13.2% 0.959
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.5 1.8 3.6
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:N/A:P
CWE-681 Incorrect Conversion between Numeric Types

When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.

CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

http://php.net/ChangeLog-5.php
Vendor Advisory
Release Notes
https://www.oracle.com/security-alerts/cpuapr2020.html
http://php.net/ChangeLog-7.php
Vendor Advisory
Release Notes
https://access.redhat.com/errata/RHSA-2018:1296
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2519
https://bugs.php.net/bug.php?id=75571
Patch
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2018/01/msg00022.html
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/01/msg00028.html
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3CZ2QADQTKRHTGB2AHD7J4QQNDLBEMM6/
https://security.gentoo.org/glsa/201903-18
Third Party Advisory
https://usn.ubuntu.com/3755-1/
Third Party Advisory