CVE-2014-2497

Published Mar 21, 2014

Last updated 18 days ago

Overview

Description
The gdImageCreateFromXpm function in gdxpm.c in libgd, as used in PHP 5.4.26 and earlier, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted color table in an XPM file.
Source
cve@mitre.org
NVD status
Modified
Products
php, ubuntu_linux, linux_enterprise_server, linux_enterprise_software_development_kit, enterprise_linux_desktop, enterprise_linux_eus, enterprise_linux_server, enterprise_linux_server_aus, enterprise_linux_server_tus, enterprise_linux_workstation, debian_linux, solaris

Risk scores

CVSS 2.0

Type
Primary
Base score
4.3
Impact score
2.9
Exploitability score
8.6
Vector string
AV:N/AC:M/Au:N/C:N/I:N/A:P

Weaknesses

nvd@nist.gov
CWE-476

Social media

Hype score
Not currently trending

Configurations

References

Sources include official advisories and independent security research.