CVE-2017-7890

The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.31 and 7.x before 7.1.7, does not zero colorMap arrays before use. A specially crafted GIF image could use the uninitialized tables to read ~700 bytes from the top of the stack, potentially disclosing sensitive information.

The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.31 and 7.x before 7.1.7, does not zero colorMap arrays before use. A specially crafted GIF image could use the uninitialized tables to read ~700 bytes from the top of the stack, potentially disclosing sensitive information.

• Fix bug #69720: Null pointer dereference in phar_get_fp_offset()
• Fix bug #70728: Type Confusion Vulnerability in PHP_to_XMLRPC_worker()
• Fix bug #70661: Use After Free Vulnerability in WDDX Packet Deserialization
• Fix bug #70741: Session WDDX Packet Deserialization Type Confusion Vulnerability
• Fix bug #71459: Integer overflow in iptcembed()
• Fix bug #71039: exec functions ignore length but look for NULL termination
• Fix bug #71354: Heap corruption in tar/zip/phar parser.
• Fix bug #71391: NULL Pointer Dereference in phar_tar_setupmetadata()
• Fix bug #71323: Output of stream_get_meta_data can be falsified by its input
• Fix bug #71498: Out-of-Bound Read in phar_parse_zipfile()
• Fix bug #71587: Use-After-Free / Double-Free in WDDX Deserialize
• Fix bug #71860: Invalid memory write in phar on filename with \0 in name
• Fix bug #71798: Integer Overflow in php_raw_url_encode
• Fix bug #72837: integer overflow in bzdecompress caused heap corruption
• Fix bug #72681: PHP Session Data Injection Vulnerability
• Fix bug #72807: integer overflow in curl_escape caused heap corruption
• Fix bug #72838: Integer overflow lead to heap corruption in sql_regcase
• Fix bug #72697: select_colors write out-of-bounds
• Fix bug #72730: imagegammacorrect allows arbitrary write access
• Fix bug #72836: integer overflow in base64_decode caused heap corruption
• Fix bug #72848: integer overflow in quoted_printable_encode caused heap corruption
• Fix bug #72849: integer overflow in urlencode caused heap corruption
• Fix bug #72850: integer overflow in php_uuencode caused heap corruption
• Fix bug #72771: ftps:// wrapper is vulnerable to protocol downgrade attack
• Fix bug #72749: wddx_deserialize allows illegal memory access
• Fix bug #72750: wddx_deserialize null dereference
• Fix bug #72790: wddx_deserialize null dereference with invalid xml
• Fix bug #72799: wddx_deserialize null dereference in php_wddx_pop_element
• Fix bug #73189: Memcpy negative size parameter php_resolve_path
• Fix bug #73150: missing NULL check in dom_document_save_html
• Fix bug #73284: heap overflow in php_ereg_replace function
• Fix bug #73218: stack-buffer-overflow through "ResourceBundle" methods
• Fix bug #73208: integer overflow in imap_8bit caused heap corruption
• Fix bug #73082: string length overflow in mb_encode_* function
• Fix bug #73174: heap overflow in php_pcre_replace_impl
• Fix bug #73276: crash in openssl_random_pseudo_bytes function
• Fix bug #73275: crash in openssl_encrypt function
• Fix bug #73017: memory corruption in wordwrap function
• Fix bug #73240: Write out of bounds at number_format
• Fix bug #73073: CachingIterator null dereference when convert to string
• Fix bug #73293: NULL pointer dereference in SimpleXMLElement::asXML()
• Fix bug #73356: crash in bzcompress function
• Fix bug #72696: imagefilltoborder stackoverflow on truecolor images
• Fix bug #73418: Integer Overflow in "_php_imap_mail" leads Heap Overflow
• Fix bug #73144: Use-after-free in ArrayObject Deserialization
• Fix bug #73192: parse_url return wrong hostname
• Fix bug #73331: NULL Pointer Dereference in WDDX Packet Deserialization with PDORow
• Fix bug #73452: Segfault (Regression for #69152)
• Fix bug #73631: Invalid read when wddx decodes empty boolean element
• Fix bug #67587: Redirection loop on nginx with FPM
• Fix bug #71465: PHAR doesn't know about litespeed
• Fix bug #73737: FPE when parsing a tag format
• Fix bug #73868: Fix DOS vulnerability in gdImageCreateFromGd2Ctx()
• Fix bug #73869: Signed Integer Overflow gd_io.c
• Fix bug #73773: Seg fault when loading hostile phar
• Fix bug #70436: Use After Free Vulnerability in unserialize()
• Fix bug #74603: PHP INI Parsing Stack Buffer Overflow Vulnerability
• Fix bug #72535: arcfour encryption stream filter crashes php
• Fix bug #72434: ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unseria
• Fix bug #72455: Heap Overflow due to integer overflows
• Fix bug #74782:…

Buffer over-read into uninitialized memory in libgd (CVE-2017-7890).

Security issues from bundled oniguruma in php-mbstring (CVE-2017-9224, CVE-2017-9226, CVE-2017-9227, CVE-2017-9228, CVE-2017-9229).

These are all security issues fixed in the gd-2.3.3-1.1 package on the GA media of openSUSE Tumbleweed.

This update for php7 fixes the following issues:

• CVE-2016-10397: parse_url() can be bypassed to return fake host. (bsc#1047454)
• CVE-2017-11142: Remoteattackers could cause a CPU consumption denial of service attack by injectinglong form variables, related to main/php_variables. (bsc#1048100)
• CVE-2017-11144: The opensslextension PEM sealing code did not check the return value of the OpenSSL sealingfunction, which could lead to a crash. (bsc#1048096)
• CVE-2017-11145: Lack of bounds checks in timelib_meridian coud lead to information leak. (bsc#1048112)
• CVE-2017-11146: Lack of bounds checks in timelib_meridian parse code could lead to information leak. (bsc#1048111)
• CVE-2017-11147: The PHAR archive handler could beused by attackers supplying malicious archive files to crash the PHP interpreteror potentially disclose information. (bsc#1048094)
• CVE-2017-11628: Stack-base dbuffer overflow in zend_ini_do_op() could lead to denial of service (bsc#1050726)
• CVE-2017-7890: Buffer over-read from unitialized data in gdImageCreateFromGifCtx function could lead to denial of service (bsc#1050241)
• CVE-2016-5766: Integer Overflow in _gd2GetHeader() resulting in heap overflow could lead to denial of service or code execution (bsc#986386)

Other fixes:

• Soap Request with References (bsc#1053645)
• php7-pear should explicitly require php7-pear-Archive_Tar otherwise this dependency must be declared in every php7-pear-* package explicitly. [bnc#1052389]

This update for php5 fixes the following issues:

• CVE-2016-10397: parse_url() can be bypassed to return fake host. (bsc#1047454)
• CVE-2017-11143: An invalid free in the WDDX deserialization of booleanparameters could be used by attackers able to inject XML for deserialization tocrash the PHP interpreter. (bsc#1048097)
• CVE-2017-11144: The opensslextension PEM sealing code did not check the return value of the OpenSSL sealingfunction, which could lead to a crash. (bsc#1048096)
• CVE-2017-11145: Lack of bounds checks in timelib_meridian coud lead to information leak. (bsc#1048112)
• CVE-2017-11146: Lack of bounds checks in timelib_meridian parse code could lead to information leak. (bsc#1048111)
• CVE-2017-11147: The PHAR archive handler could beused by attackers supplying malicious archive files to crash the PHP interpreteror potentially disclose information. (bsc#1048094)
• CVE-2016-5766: Integer Overflow in _gd2GetHeader() resulting could lead to heap overflow (bsc#986386)
• CVE-2017-11628: Stack-base dbuffer overflow in zend_ini_do_op() in Zend/zend_ini_parser.c (bsc#1050726)
• CVE-2017-7890: Buffer over-read from unitialized data in gdImageCreateFromGifCtx function could lead to denial of service (bsc#1050241)

This update for php53 fixes the several issues.

These security issues were fixed:

• CVE-2017-12933: The finish_nested_data function in ext/standard/var_unserializer.re was prone to a buffer over-read while unserializing untrusted data. Exploitation of this issue could have had an unspecified impact on the integrity of PHP (bsc#1054430).
• CVE-2017-11628: Stack-based buffer overflow in the zend_ini_do_op() function in Zend/zend_ini_parser.c could have caused a denial of service or potentially allowed executing code (bsc#1050726).
• CVE-2017-7890: The GIF decoding function gdImageCreateFromGifCtx in the GD Graphics Library did not zero colorMap arrays use. A specially crafted GIF image could use the uninitialized tables to read ~700 bytes from the top of the stack, potentially disclosing sensitive information (bsc#1050241).
• CVE-2016-5766: Integer overflow in the _gd2GetHeader in the GD Graphics Library (aka libgd) allowed remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via crafted chunk dimensions in an image (bsc#986386).
• CVE-2017-11145: An error in the date extension's timelib_meridian parsing code could have been used by attackers able to supply date strings to leak information from the interpreter, related to ext/date/lib/parse_date.c out-of-bounds reads affecting the php_parse_date function (bsc#1048112).
• CVE-2017-11146: Lack of bounds checks in timelib_meridian parse code could have lead to information leak [bsc#1048111]
• CVE-2016-10397: Incorrect handling of various URI components in the URL parser could have been used by attackers to bypass hostname-specific URL checks (bsc#1047454).
• CVE-2017-11147: The PHAR archive handler could have been used by attackers supplying malicious archive files to crash the PHP interpreter or potentially disclose information due to a buffer over-read in the phar_parse_pharfile function (bsc#1048094).
• CVE-2017-11144: The openssl extension PEM sealing code did not check the return value of the OpenSSL sealing function, which could have lead to a crash of the PHP interpreter (bsc#1048096).

This update for gd fixes the following issues:

• CVE-2017-7890: Fixed a buffer over-read into uninitialized memory (bsc#1050241).
• CVE-2018-14553: Fixed a null pointer dereference in gdImageClone() (bsc#1165471).
• CVE-2019-11038: Fixed a information disclosure in gdImageCreateFromXbm() (bsc#1140120).

A vulnerability was discovered in GD Graphics Library (aka libgd), as used in PHP that does not zero colorMap arrays before use. A specially crafted GIF image could use the uninitialized tables to read bytes from the top of the stack.