The gdGetColors function in gdgd.c in PHP 5.2.11 and 5.3.x before 5.3.1, and the GD Graphics Library 2.x, does not properly verify a certain colorsTotal structure member, which might allow remote attackers to conduct buffer overflow or buffer over-read attacks via a crafted GD file, a different vulnerability than CVE-2009-3293. NOTE: some of these details are obtained from third party information.

The GD Graphics Library (aka LibGD) 2.2.5 has a double free in the gdImagePtr() functions in gdgifout.c, gdjpeg.c, and gdwbmp.c. NOTE: PHP is unaffected.

References: https://github.com/libgd/libgd/issues/492

Upstream Patch: https://github.com/libgd/libgd/commit/553702980ae89c83f2d6e254d62cf82e204956d0 https://github.com/php/php-src/commit/089f7c0bc28d399b0420aa6ef058e4c1c120b2ae