CVE-2015-8874 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Libgd2

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-674 — Uncontrolled Recursion9 documents8 sources

Severity

7.5HIGHNVD

OSV4.3

EPSS

3.8%

top 11.93%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Debian Libgd2 PHP Opensuse Leap

Timeline

PublishedMay 16

Latest updateMay 14

Description

Stack consumption vulnerability in GD in PHP before 5.6.12 allows remote attackers to cause a denial of service via a crafted imagefilltoborder call.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/libgd2< libgd2 2.2.1-1 (bookworm)

▶NVDphp/php5.6.11

▶NVDopensuse/leap42.1

🔴Vulnerability Details

GHSA

GHSA-q9v4-889r-h8qj: Stack consumption vulnerability in GD in PHP before 5↗2022-05-14

▶

OSV

libgd2 vulnerabilities↗2016-05-31

▶

OSV

CVE-2015-8874: Stack consumption vulnerability in GD in PHP before 5↗2016-05-16

▶

📋Vendor Advisories

Ubuntu

GD library vulnerabilities↗2016-05-31

▶

Red Hat

gd: gdImageFillToBorder deep recursion leading to stack overflow↗2015-06-02

▶

Debian

CVE-2015-8874: libgd2 - Stack consumption vulnerability in GD in PHP before 5.6.12 allows remote attacke...↗2015

▶

💬Community

HackerOne

CVE-2015-8874 Stack overflow with imagefilltoborder↗2019-10-13

▶

Bugzilla

CVE-2015-8874 gd: gdImageFillToBorder deep recursion leading to stack overflow↗2016-05-17

▶