CVE-2008-3658: Buffer Overflow
Published Aug 15, 2008
·Updated
Buffer overflow in the imageloadfont function in ext/gd/gd.c in PHP 4.4.x before 4.4.9 and PHP 5.2 before 5.2.6-r6 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted font file.
Affected Software
16 affected components
PHP PHP=4.4.4
PHP PHP=5.2.2
PHP PHP=5.2.5
PHP PHP=4.4.2
PHP PHP=5.2.6
PHP PHP=4.4.3
PHP PHP=5.2.3
PHP PHP=4.4.5
PHP PHP=4.4.8
PHP PHP=5.2.0
PHP PHP=5.2.4
PHP PHP=4.4.0
PHP PHP=4.4.6
PHP PHP=4.4.1
PHP PHP=5.2.1
PHP PHP=4.4.7
Event History
Aug 15, 2008
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2008-3658?
CVE-2008-3658 is considered high severity due to its potential to cause denial of service and possible arbitrary code execution.
2
How do I fix CVE-2008-3658?
To fix CVE-2008-3658, upgrade PHP to version 4.4.9 or 5.2.6-r6 or later.
3
Which versions of PHP are affected by CVE-2008-3658?
CVE-2008-3658 affects PHP versions 4.4.0 through 4.4.8 and 5.2.0 through 5.2.5.
4
What type of attack does CVE-2008-3658 enable?
CVE-2008-3658 enables context-dependent attackers to exploit buffer overflow vulnerabilities leading to potential code execution.
5
Can CVE-2008-3658 lead to a denial of service?
Yes, CVE-2008-3658 can cause a denial of service by crashing the PHP application.