CVE-2007-3996

Advisory lineage Upstream: 0 Downstream: 7
Modified
Published: 04 Sept 2007, 18:00
Last modified:07 Aug 2024, 14:37

Vulnerability Summary

Overall Risk (default)
medium
30/100
CVSS Score
6.8 MEDIUM
v2.0 (nvd)
EPSS Score
15.13% MEDIUM
15% probability +5.56%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

04 Sept 2007, 18:00
Published
Vulnerability first disclosed
07 Aug 2024, 14:37
Last Modified
Vulnerability information updated

Description

Multiple integer overflows in libgd in PHP before 5.2.4 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large (1) srcW or (2) srcH value to the (a) gdImageCopyResized function, or a large (3) sy (height) or (4) sx (width) value to the (b) gdImageCreate or the (c) gdImageCreateTrueColor function.

CVSS Metrics

  • v2.0•MEDIUM•Score: 6.8AV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 15.13%• Percentile: 95%

Techniques & Countermeasures

  • CWE-189•Numeric Errors

    Weaknesses in this category are related to improper calculation or conversion of numbers.

Affected Systems

  • Unknown•PHP

    ≤ 5.2.3

References (40)