CVE-2014-2497: Null Pointer Dereference
It was reported [1] that the gdImageCreateFromXpm() function in libgd could dereference a NULL pointer, noting:
"The call to strlen() parses image.colorTable[i].ccolor which is initialised as NULL if the particular color mapping uses a different key (such as monochrome/monovisual)."
This was reported against PHP, which includes an embedded copy of the gd library. CVE-2014-2497 was assigned to this issue [2].
[1] https://bugs.php.net/bug.php?id=66901 [2] http://seclists.org/oss-sec/2014/q1/580
Other sources
The gdImageCreateFromXpm function in gdxpm.c in libgd, as used in PHP 5.4.26 and earlier, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted color table in an XPM file.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 5.5.16 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 5.4.32
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2497?
CVE-2014-2497 has been classified as a medium severity vulnerability due to the potential for denial of service.
How do I fix CVE-2014-2497?
To fix CVE-2014-2497, upgrade to PHP version 5.4.32 or 5.5.16 or later.
Which versions of PHP are affected by CVE-2014-2497?
CVE-2014-2497 affects PHP versions prior to 5.4.32 and between 5.5.0 and 5.5.16.
What function in libgd is related to CVE-2014-2497?
The vulnerability in CVE-2014-2497 is related to the gdImageCreateFromXpm() function in libgd.
On which operating systems can CVE-2014-2497 be found?
CVE-2014-2497 can be found in various Linux distributions including Red Hat, Ubuntu, and SUSE.