CVE-2018-5711

Advisory lineage Upstream: 0 Downstream: 17
Modified
Published: 16 Jan 2018, 09:00
Last modified:05 Aug 2024, 05:40

Vulnerability Summary

Overall Risk (default)
low
24/100
CVSS Score
5.5 MEDIUM
v3.0 (nvd)
EPSS Score
10.27% MEDIUM
10% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

16 Jan 2018, 09:00
Published
Vulnerability first disclosed
05 Aug 2024, 05:40
Last Modified
Vulnerability information updated

Description

gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1, has an integer signedness error that leads to an infinite loop via a crafted GIF file, as demonstrated by a call to the imagecreatefromgif or imagecreatefromstring PHP function. This is related to GetCode_ and gdImageCreateFromGifCtx.

CVSS Metrics

  • v3.0•MEDIUM•Score: 5.5CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
  • v2.0•MEDIUM•Score: 4.3AV:N/AC:M/Au:N/C:N/I:N/A:P

EPSS Trends

Current EPSS score: 10.27%• Percentile: 93%

Techniques & Countermeasures

  • CWE-681•Incorrect Conversion between Numeric Types

    When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.

  • CWE-835•Loop with Unreachable Exit Condition ('Infinite Loop')

    The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Affected Systems

  • canonical•ubuntu_linux

    14.04 | 16.04 | 18.04

  • debian•debian_linux

    7.0 | 8.0

  • Unknown•PHP

    ≤ 5.6.32 | ≥ 7.0.0, ≤ 7.0.26 | > 7.1.0, ≤ 7.1.12 | 7.2.0

References (11)