The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.x before 5.3.1, and the GD Graphics Library 2.x, does not properly verify a certain colorsTotal structure member, which might allow remote attackers to conduct buffer overflow or buffer over-read attacks via a crafted GD file, a different vulnerability than CVE-2009-3293. NOTE: some of these details are obtained from third party information.
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
| Link | Tags |
|---|---|
| http://www.mandriva.com/security/advisories?name=MDVSA-2009:285 | vendor advisory |
| http://secunia.com/advisories/37069 | third party advisory vendor advisory |
| http://www.redhat.com/support/errata/RHSA-2010-0003.html | vendor advisory |
| http://secunia.com/advisories/37080 | third party advisory vendor advisory |
| http://www.securityfocus.com/bid/36712 | vdb entry |
| http://secunia.com/advisories/38055 | third party advisory vendor advisory |
| http://www.vupen.com/english/advisories/2009/2929 | vdb entry vendor advisory |
| http://marc.info/?l=oss-security&m=125562113503923&w=2 | mailing list |
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11199 | vdb entry signature |
| http://svn.php.net/viewvc?view=revision&revision=289557 | |
| http://www.openwall.com/lists/oss-security/2009/11/20/5 | mailing list |
| http://www.vupen.com/english/advisories/2009/2930 | vdb entry patch vendor advisory |