CVE-2009-3546

La función _gdGetColors en el archivo gd_gd.c en PHP versión 5.2.11 y versiones 5.3.x anteriores a 5.3.1, y GD Graphics Library versiones 2.x, no comprueba apropiadamente un determinado miembro de la estructura colorTotal, lo que podría permitir a los atacantes remotos conducir ataques de desbordamiento de búfer o de lectura excesiva de búfer por medio de un archivo GD especialmente diseñado, una vulnerabilidad diferente de CVE-2009-3293. NOTA: algunos de estos datos fueron obtenidos de la información de terceros.

Tomas Hoger discovered that the GD library did not properly handle the number of colors in certain malformed GD images. If a user or automated system were tricked into processing a specially crafted GD image, an attacker could cause a denial of service or possibly execute arbitrary code. It was discovered that the GD library did not properly handle incorrect color indexes. An attacker could send specially crafted input to applications linked against libgd2 and cause a denial of service or possibly execute arbitrary code. This issue only affected Ubuntu 6.06 LTS. It was discovered that the GD library did not properly handle certain malformed GIF images. If a user or automated system were tricked into processing a specially crafted GIF image, an attacker could cause a denial of service. This issue only affected Ubuntu 6.06 LTS. It was discovered that the GD library did not properly handle large angle degree values. An attacker could send specially crafted input to applications linked against libgd2 and cause a denial of service. This issue only affected Ubuntu 6.06 LTS.