Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability - CVE-2017-7890 - Vulnerability Database
PHP

PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability - CVE-2017-7890

Medium
Reference: CVE-2017-7890
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2017-7890
Title: PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
Overview:

The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c in the GD Graphics Library (aka libgd) as used in PHP before 5.6.31 and 7.x before 7.1.7 does not zero colorMap arrays before use. A specially crafted GIF image could use the uninitialized tables to read 700 bytes from the top of the stack potentially disclosing sensitive information.