CVE-2017-7890

Description

The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.31 and 7.x before 7.1.7, does not zero colorMap arrays before use. A specially crafted GIF image could use the uninitialized tables to read ~700 bytes from the top of the stack, potentially disclosing sensitive information.

Weakness classification

• CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Primary references

• cve@mitre.org — Release Notes, Vendor Advisory
• cve@mitre.org — Release Notes, Vendor Advisory
• cve@mitre.org
• cve@mitre.org — Third Party Advisory, VDB Entry
• cve@mitre.org
• cve@mitre.org
• cve@mitre.org — Patch, Vendor Advisory
• cve@mitre.org — Issue Tracking, Patch, Vendor Advisory
• cve@mitre.org
• cve@mitre.org
• af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Vendor Advisory