CVE-2006-4484: php

Modified

AliasesDEBIAN-CVE-2006-4484openSUSE-SU-2024:10484-1

Published 31-08-2006Last modified 07-08-2024

Some data may be incomplete

1 reference with an unsupported link type was hidden.

Vulnerability summary

CVE-2006-4484 is a low (CVSS 2.6) vulnerability in php. EPSS estimates a 8.68% chance of exploitation in the next 30 days, higher than 95.1% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Routine

Not severe (CVSS 2.6, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

2.6/10

010

Low · v2.0 (NVD)

EPSS score

8.68%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 3

RHSA-2006:0669 RHSA-2006:0688 RHSA-2008:0146

Timeline

31-08-2006
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Buffer overflow in the LWZReadByte_ function in ext/gd/libgd/gd_gif_in.c in the GD extension in PHP before 5.1.5 allows remote attackers to have an unknown impact via a GIF file with input_code_size greater than MAX_LWZ_BITS, which triggers an overflow when initializing the table array.

CVSS metrics

1 score · 1 source · 1 version

v2.02.6

EPSS trend

Probability

8.68%

Chance of exploitation in the next 30 days

Percentile

95%

Versus all other CVEs

30-day change

No change 0.00 pp

From 8.68% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

referenceUnverified
Exploit Reference (bugs.php.net)
Maturity: unknown

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Debian2 products

libgd2< 2.0.33-5.1
xloadimageAll versions (No fix recorded)

Opensuse1 product

perl-Tk&distro=openSUSE Tumbleweed< 804.033-1.10

Php1 product

phpEOL5.1.0 | 5.1.1 | 5.1.2 | 5.1.4

3 vendors · 4 products

References

51 links

secunia.com/advisories/28768Third Party AdvisoryX Refsource SECUNIA
securitytracker.com/id?1016984VDB EntryX Refsource SECTRACK
www.securityfocus.com/archive/1/487683/100/0/threadedMailing ListX Refsource BUGTRAQ
www.php.net/release_5_1_5.phpX Refsource CONFIRMPatch
issues.rpath.com/browse/RPL-683X Refsource CONFIRM
secunia.com/advisories/21768Third Party AdvisoryX Refsource SECUNIAVendor Advisory
cvs.php.net/viewvc.cgi/php-src/ext/gd/libgd/gd_gif_in.c?r1=1.10&r2=1.11X Refsource CONFIRMPatch
secunia.com/advisories/29546Third Party AdvisoryX Refsource SECUNIA
wiki.rpath.com/Advisories:rPSA-2008-0046X Refsource CONFIRM
issues.rpath.com/browse/RPL-2218X Refsource CONFIRM

Show all 51 references

secunia.com/advisories/29157Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/22487Third Party AdvisoryX Refsource SECUNIA
www.ubuntu.com/usn/usn-342-1Vendor AdvisoryX Refsource UBUNTU
secunia.com/advisories/29242Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/22039Third Party AdvisoryX Refsource SECUNIA
www.turbolinux.com/security/2006/TLSA-2006-38.txtVendor AdvisoryX Refsource TURBO
secunia.com/advisories/28845Third Party AdvisoryX Refsource SECUNIA
rhn.redhat.com/errata/RHSA-2006-0688.htmlVendor AdvisoryX Refsource REDHAT
www.redhat.com/archives/fedora-package-announce/2008-February/msg00502.htmlVendor AdvisoryX Refsource FEDORA
www.mandriva.com/security/advisories?name=MDKSA-2006:162Vendor AdvisoryX Refsource MANDRIVA
lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.htmlVendor AdvisoryX Refsource SUSE
www.securityfocus.com/bid/19582VDB EntryX Refsource BID
www.mandriva.com/security/advisories?name=MDVSA-2008:077Vendor AdvisoryX Refsource MANDRIVA
support.avaya.com/elmodocs2/security/ASA-2006-222.htmX Refsource CONFIRM
cvs.php.net/viewvc.cgi/php-src/ext/gd/libgd/gd_gif_in.c?view=logX Refsource CONFIRMPatch
secunia.com/advisories/22538Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/21546Third Party AdvisoryX Refsource SECUNIAPatchVendor Advisory
secunia.com/advisories/22440Third Party AdvisoryX Refsource SECUNIA
www.securityfocus.com/archive/1/447866/100/0/threadedMailing ListX Refsource BUGTRAQ
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9004VDB EntrySignatureX Refsource OVAL
secunia.com/advisories/22069Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2006/3318VDB EntryX Refsource VUPEN
secunia.com/advisories/22225Third Party AdvisoryX Refsource SECUNIA
wiki.rpath.com/wiki/Advisories:rPSA-2008-0046X Refsource CONFIRM
support.avaya.com/elmodocs2/security/ASA-2006-223.htmX Refsource CONFIRM
secunia.com/advisories/28959Third Party AdvisoryX Refsource SECUNIA
www.mandriva.com/security/advisories?name=MDVSA-2008:038Vendor AdvisoryX Refsource MANDRIVA
www.redhat.com/support/errata/RHSA-2008-0146.htmlVendor AdvisoryX Refsource REDHAT
www.php.net/ChangeLog-5.phpX Refsource CONFIRM
secunia.com/advisories/28838Third Party AdvisoryX Refsource SECUNIA
www.securityfocus.com/archive/1/488008/100/0/threadedMailing ListX Refsource BUGTRAQ
secunia.com/advisories/21842Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/28866Third Party AdvisoryX Refsource SECUNIA
lists.opensuse.org/opensuse-security-announce/2008-02/msg00003.htmlVendor AdvisoryX Refsource SUSE
bugs.php.net/bug.php?id=38112X Refsource CONFIRMExploit
bugzilla.redhat.com/show_bug.cgi?id=431568X Refsource CONFIRM
www.novell.com/linux/security/advisories/2008_13_sr.htmlVendor AdvisoryX Refsource SUSE
www.novell.com/linux/security/advisories/2006_52_php.htmlVendor AdvisoryX Refsource SUSE
secunia.com/advisories/30717Third Party AdvisoryX Refsource SECUNIA
security-tracker.debian.org/tracker/CVE-2006-4484Advisory
www.suse.com/security/cve/CVE-2006-4484WEB