Every CVE Search/ Get API key

CVE-2007-4033

Buffer overflow in the intT1_EnvGetCompletePath function in lib/t1lib/t1env.c in t1lib 5.1.1...

7.5 HighPublic exploitFix available

CVE-2007-4033 is a high vulnerability (CVSS 7.5) in Php, published July 27, 2007. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 18.7%, the 97th percentile. Fixed in t1lib 5.0.2-3sarge1.

Buffer overflow in the intT1_EnvGetCompletePath function in lib/t1lib/t1env.c in t1lib 5.1.1 allows context-dependent attackers to execute arbitrary code via a long FileName parameter. NOTE: this issue was originally reported to be in the imagepsloadfont function in php_gd2.dll in the gd (PHP_GD2) extension in PHP 5.2.3.

Exploit likelihood

18.7%Down 9.3 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

Buffer overflow in the intT1_EnvGetCompletePath function in lib/t1lib/t1env.c in t1lib 5.1.1 allows context-dependent attackers to execute arbitrary code via a long FileName parameter. NOTE: this issue was originally reported to be in the imagepsloadfont function in php_gd2.dll in the gd (PHP_GD2) extension in PHP 5.2.3.

Record
CVE-2007-4033
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

Buffer overflow in the intT1_EnvGetCompletePath function in lib/t1lib/t1env.c in t1lib 5.1.1 allows context-dependent attackers to execute arbitrary code via a long FileName parameter. NOTE: this issue was originally reported to be in the imagepsloadfont function in php_gd2.dll in the gd (PHP_GD2) extension in PHP 5.2.3.

Record
CVE-2007-4033
Updated
2026-11-02
EUVDEUVD-2007-4017 No score

Buffer overflow in the intT1_EnvGetCompletePath function in lib/t1lib/t1env.c in t1lib 5.1.1 allows context-dependent attackers to execute arbitrary code via a long FileName parameter. NOTE: this issue was originally reported to be in the imagepsloadfont function in php_gd2.dll in the gd (PHP_GD2) extension in PHP 5.2.3.

Record
EUVD-2007-4017
Updated
2026-11-03
GitHub AdvisoriesGHSA-5vjf-7425-428p No score

Buffer overflow in the intT1_EnvGetCompletePath function in lib/t1lib/t1env.c in t1lib 5.1.1...

Buffer overflow in the intT1_EnvGetCompletePath function in lib/t1lib/t1env.c in t1lib 5.1.1 allows context-dependent attackers to execute arbitrary code via a long FileName parameter. NOTE: this issue was originally reported to be in the imagepsloadfont function in php_gd2.dll in the gd (PHP_GD2) extension in PHP 5.2.3.

Record
GHSA-5vjf-7425-428p
Weakness
CWE-119
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
t1lib
Debian:3.1
 before 5.0.2-3sarge1, plus listed versions
5.0.2-3
5.0.2-3sarge1
t1lib
Debian:4.0
 before 5.1.0-2etch1, plus listed versions
5.1.0-2
5.1.0-2etch1
tetex
Red Hat:enterprise_linux:4::as
 before 0:2.0.2-22.0.1.EL4.10
0:2.0.2-22.0.1.EL4.10
tetex-afm
Red Hat:enterprise_linux:4::as
 before 0:2.0.2-22.0.1.EL4.10
0:2.0.2-22.0.1.EL4.10
tetex-debuginfo
Red Hat:enterprise_linux:4::as
 before 0:2.0.2-22.0.1.EL4.10
0:2.0.2-22.0.1.EL4.10
tetex-doc
Red Hat:enterprise_linux:4::as
 before 0:2.0.2-22.0.1.EL4.10
0:2.0.2-22.0.1.EL4.10
tetex-dvips
Red Hat:enterprise_linux:4::as
 before 0:2.0.2-22.0.1.EL4.10
0:2.0.2-22.0.1.EL4.10
tetex-fonts
Red Hat:enterprise_linux:4::as
 before 0:2.0.2-22.0.1.EL4.10
0:2.0.2-22.0.1.EL4.10
tetex-latex
Red Hat:enterprise_linux:4::as
 before 0:2.0.2-22.0.1.EL4.10
0:2.0.2-22.0.1.EL4.10
tetex-xdvi
Red Hat:enterprise_linux:4::as
 before 0:2.0.2-22.0.1.EL4.10
0:2.0.2-22.0.1.EL4.10
Show 52 moreShow less
Affected packages
PackageAffectedFixed
tetex
Red Hat:enterprise_linux:4::desktop
 before 0:2.0.2-22.0.1.EL4.10
0:2.0.2-22.0.1.EL4.10
tetex-afm
Red Hat:enterprise_linux:4::desktop
 before 0:2.0.2-22.0.1.EL4.10
0:2.0.2-22.0.1.EL4.10
tetex-debuginfo
Red Hat:enterprise_linux:4::desktop
 before 0:2.0.2-22.0.1.EL4.10
0:2.0.2-22.0.1.EL4.10
tetex-doc
Red Hat:enterprise_linux:4::desktop
 before 0:2.0.2-22.0.1.EL4.10
0:2.0.2-22.0.1.EL4.10
tetex-dvips
Red Hat:enterprise_linux:4::desktop
 before 0:2.0.2-22.0.1.EL4.10
0:2.0.2-22.0.1.EL4.10
tetex-fonts
Red Hat:enterprise_linux:4::desktop
 before 0:2.0.2-22.0.1.EL4.10
0:2.0.2-22.0.1.EL4.10
tetex-latex
Red Hat:enterprise_linux:4::desktop
 before 0:2.0.2-22.0.1.EL4.10
0:2.0.2-22.0.1.EL4.10
tetex-xdvi
Red Hat:enterprise_linux:4::desktop
 before 0:2.0.2-22.0.1.EL4.10
0:2.0.2-22.0.1.EL4.10
tetex
Red Hat:enterprise_linux:4::es
 before 0:2.0.2-22.0.1.EL4.10
0:2.0.2-22.0.1.EL4.10
tetex-afm
Red Hat:enterprise_linux:4::es
 before 0:2.0.2-22.0.1.EL4.10
0:2.0.2-22.0.1.EL4.10
tetex-debuginfo
Red Hat:enterprise_linux:4::es
 before 0:2.0.2-22.0.1.EL4.10
0:2.0.2-22.0.1.EL4.10
tetex-doc
Red Hat:enterprise_linux:4::es
 before 0:2.0.2-22.0.1.EL4.10
0:2.0.2-22.0.1.EL4.10
tetex-dvips
Red Hat:enterprise_linux:4::es
 before 0:2.0.2-22.0.1.EL4.10
0:2.0.2-22.0.1.EL4.10
tetex-fonts
Red Hat:enterprise_linux:4::es
 before 0:2.0.2-22.0.1.EL4.10
0:2.0.2-22.0.1.EL4.10
tetex-latex
Red Hat:enterprise_linux:4::es
 before 0:2.0.2-22.0.1.EL4.10
0:2.0.2-22.0.1.EL4.10
tetex-xdvi
Red Hat:enterprise_linux:4::es
 before 0:2.0.2-22.0.1.EL4.10
0:2.0.2-22.0.1.EL4.10
tetex
Red Hat:enterprise_linux:4::ws
 before 0:2.0.2-22.0.1.EL4.10
0:2.0.2-22.0.1.EL4.10
tetex-afm
Red Hat:enterprise_linux:4::ws
 before 0:2.0.2-22.0.1.EL4.10
0:2.0.2-22.0.1.EL4.10
tetex-debuginfo
Red Hat:enterprise_linux:4::ws
 before 0:2.0.2-22.0.1.EL4.10
0:2.0.2-22.0.1.EL4.10
tetex-doc
Red Hat:enterprise_linux:4::ws
 before 0:2.0.2-22.0.1.EL4.10
0:2.0.2-22.0.1.EL4.10
tetex-dvips
Red Hat:enterprise_linux:4::ws
 before 0:2.0.2-22.0.1.EL4.10
0:2.0.2-22.0.1.EL4.10
tetex-fonts
Red Hat:enterprise_linux:4::ws
 before 0:2.0.2-22.0.1.EL4.10
0:2.0.2-22.0.1.EL4.10
tetex-latex
Red Hat:enterprise_linux:4::ws
 before 0:2.0.2-22.0.1.EL4.10
0:2.0.2-22.0.1.EL4.10
tetex-xdvi
Red Hat:enterprise_linux:4::ws
 before 0:2.0.2-22.0.1.EL4.10
0:2.0.2-22.0.1.EL4.10
tetex
Red Hat:enterprise_linux:5::client
 before 0:3.0-33.2.el5_1.2
0:3.0-33.2.el5_1.2
tetex-afm
Red Hat:enterprise_linux:5::client
 before 0:3.0-33.2.el5_1.2
0:3.0-33.2.el5_1.2
tetex-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:3.0-33.2.el5_1.2
0:3.0-33.2.el5_1.2
tetex-doc
Red Hat:enterprise_linux:5::client
 before 0:3.0-33.2.el5_1.2
0:3.0-33.2.el5_1.2
tetex-dvips
Red Hat:enterprise_linux:5::client
 before 0:3.0-33.2.el5_1.2
0:3.0-33.2.el5_1.2
tetex-fonts
Red Hat:enterprise_linux:5::client
 before 0:3.0-33.2.el5_1.2
0:3.0-33.2.el5_1.2
tetex-latex
Red Hat:enterprise_linux:5::client
 before 0:3.0-33.2.el5_1.2
0:3.0-33.2.el5_1.2
tetex-xdvi
Red Hat:enterprise_linux:5::client
 before 0:3.0-33.2.el5_1.2
0:3.0-33.2.el5_1.2
tetex
Red Hat:enterprise_linux:5::server
 before 0:3.0-33.2.el5_1.2
0:3.0-33.2.el5_1.2
tetex-afm
Red Hat:enterprise_linux:5::server
 before 0:3.0-33.2.el5_1.2
0:3.0-33.2.el5_1.2
tetex-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:3.0-33.2.el5_1.2
0:3.0-33.2.el5_1.2
tetex-doc
Red Hat:enterprise_linux:5::server
 before 0:3.0-33.2.el5_1.2
0:3.0-33.2.el5_1.2
tetex-dvips
Red Hat:enterprise_linux:5::server
 before 0:3.0-33.2.el5_1.2
0:3.0-33.2.el5_1.2
tetex-fonts
Red Hat:enterprise_linux:5::server
 before 0:3.0-33.2.el5_1.2
0:3.0-33.2.el5_1.2
tetex-latex
Red Hat:enterprise_linux:5::server
 before 0:3.0-33.2.el5_1.2
0:3.0-33.2.el5_1.2
tetex-xdvi
Red Hat:enterprise_linux:5::server
 before 0:3.0-33.2.el5_1.2
0:3.0-33.2.el5_1.2
xpdf
Red Hat:enterprise_linux:3::as
 before 1:2.02-11.el3
1:2.02-11.el3
xpdf-debuginfo
Red Hat:enterprise_linux:3::as
 before 1:2.02-11.el3
1:2.02-11.el3
xpdf
Red Hat:enterprise_linux:3::desktop
 before 1:2.02-11.el3
1:2.02-11.el3
xpdf-debuginfo
Red Hat:enterprise_linux:3::desktop
 before 1:2.02-11.el3
1:2.02-11.el3
xpdf
Red Hat:enterprise_linux:3::es
 before 1:2.02-11.el3
1:2.02-11.el3
xpdf-debuginfo
Red Hat:enterprise_linux:3::es
 before 1:2.02-11.el3
1:2.02-11.el3
xpdf
Red Hat:enterprise_linux:3::ws
 before 1:2.02-11.el3
1:2.02-11.el3
xpdf-debuginfo
Red Hat:enterprise_linux:3::ws
 before 1:2.02-11.el3
1:2.02-11.el3
xpdf
Red Hat:enterprise_linux:2.1::as
 before 1:0.92-19.el2
1:0.92-19.el2
xpdf
Red Hat:enterprise_linux:2.1::aw
 before 1:0.92-19.el2
1:0.92-19.el2
xpdf
Red Hat:enterprise_linux:2.1::es
 before 1:0.92-19.el2
1:0.92-19.el2
xpdf
Red Hat:enterprise_linux:2.1::ws
 before 1:0.92-19.el2
1:0.92-19.el2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBT1lib - 'intT1_Env_GetCompletePath' Buffer Overflow (PoC)2007-07-26
Exploit-DBPHP 5.2.3 - 'PHP_gd2.dll' imagepsloadfont Local Buffer Overflow (PoC)2007-07-26

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

References

Show 58 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open