CVE-2022-31630: OOB read due to insufficient input validation in imageloadfont()
Fixed bug : OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
Other sources
In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() function, the read outside allocated buffer will be used. This can lead to crashes or disclosure of confidential information.
— Launchpad
In PHP versions prior to 7.4.33, 8.0.25 and 8.2.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() function, the read outside allocated buffer will be used. This can lead to crashes or disclosure of confidential information.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-31630.
What is the title of the vulnerability?
The title of the vulnerability is Fixed bug: OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630).
What is the severity of CVE-2022-31630?
The severity of CVE-2022-31630 is not specified.
How does CVE-2022-31630 affect PHP?
CVE-2022-31630 affects PHP versions prior to 7.4.33, 8.0.25, and 8.2.12.
How can I fix CVE-2022-31630?
To fix CVE-2022-31630, upgrade to PHP version 7.4.33 or apply the recommended patches.