CVE-2017-7890: Infoleak
A flaw was found in php. The GIF decoding function gdImageCreateFromGifCtx in gdgifin.c (which can be reached with a call to the imagecreatefromstring() function) uses constant-sized color tables of size 3 256, but does not zero-out these arrays before use. This flaw could lead to a information leak through a specially crafted image with bogus color table.
Upstream bug:
https://bugs.php.net/bug.php?id=74435
Upstream patch:
http://git.php.net/?p=php-src.git;a=commit;h=018092125538782b25d3ab6b036f0c8d5968f757 http://git.php.net/?p=php-src.git;a=commit;h=8dc4f4dc9e44d1cbfe4654aa6e0dc27c94913938 https://bugs.php.net/patch-display.php?bug=74435&patch=fix-74435-php-7.0&revision=1497970038
References:
http://php.net/ChangeLog-5.php
Other sources
Fixed bug (Buffer over-read into uninitialized memory). (CVE-2017-7890)
— PHP
The GIF decoding function gdImageCreateFromGifCtx in gdgifin.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.31 and 7.x before 7.1.7, does not zero colorMap arrays before use. A specially crafted GIF image could use the uninitialized tables to read ~700 bytes from the top of the stack, potentially disclosing sensitive information.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7890?
CVE-2017-7890 is classified as a medium severity vulnerability due to the potential for information disclosure.
How do I fix CVE-2017-7890?
To fix CVE-2017-7890, upgrade to PHP version 5.6.31 or 7.0.21 or later.
What versions of PHP are affected by CVE-2017-7890?
CVE-2017-7890 affects PHP versions prior to 5.6.31, 7.0.20, and 7.1.6.
What types of attacks can be executed using CVE-2017-7890?
An attacker can exploit CVE-2017-7890 to retrieve sensitive information from server memory by providing a crafted GIF image.
Is CVE-2017-7890 a remote or local vulnerability?
CVE-2017-7890 can be exploited remotely by an attacker through the upload and processing of a malicious GIF file.