Description
Buffer overflow in the LWZReadByte_ function in ext/gd/libgd/gd_gif_in.c in the GD extension in PHP before 5.1.5 allows remote attackers to have an unknown impact via a GIF file with input_code_size greater than MAX_LWZ_BITS, which triggers an overflow when initializing the table array.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libgd2 | 2.0.33-5.1 | — |
| Debian 14 | xloadimage | No fix yet | — |
| Debian 13 | libgd2 | 2.0.33-5.1 | — |
| Debian 13 | xloadimage | No fix yet | — |
| Debian 12 | libgd2 | 2.0.33-5.1 | — |
| Debian 12 | xloadimage | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | gd +2 | 2.0.33-9.4.el5_1.1 | RHSA-2008:0146 |
| RHEL 4 | gd +2 | 2.0.28-5.4E.el4_6.1 | RHSA-2008:0146 |
| RHEL 4 | php +13 | 4.3.9-3.18 | RHSA-2006:0669 |
| RHEL 3 | php +6 | 4.3.2-36.ent | RHSA-2006:0669 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Application Stack 1 | php +16 | 5.1.4-1.el4s1.4 | RHSA-2006:0688 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | perl-Tk | 804.033-1.10 | openSUSE-SU-2024:10484-1 |
Advisories 4
- RHSA-2006:0669 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2006:0688 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0146 Red Hat Security Advisory: gd security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- openSUSE-SU-2024:10484-1 perl-Tk-804.033-1.10 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- 28768 third-party-advisory
- 1016984 vdb-entry
- 20080206 rPSA-2008-0046-1 gd mailing-list
- http://www.php.net/release_5_1_5.php
- https://issues.rpath.com/browse/RPL-683
- 21768 third-party-advisory
- http://cvs.php.net/viewvc.cgi/php-src/ext/gd/libgd/gd_gif_in.c?r1=1.10&r2=1.11
- 29546 third-party-advisory
- http://wiki.rpath.com/Advisories:rPSA-2008-0046
- https://issues.rpath.com/browse/RPL-2218
- 29157 third-party-advisory
- 22487 third-party-advisory
- USN-342-1 vendor-advisory
- 29242 third-party-advisory
- 22039 third-party-advisory
- TLSA-2006-38 vendor-advisory
- 28845 third-party-advisory
- RHSA-2006:0688 vendor-advisory
- FEDORA-2008-1643 vendor-advisory
- MDKSA-2006:162 vendor-advisory
- SUSE-SR:2008:005 vendor-advisory
- 19582 vdb-entry
- MDVSA-2008:077 vendor-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2006-222.htm
- http://cvs.php.net/viewvc.cgi/php-src/ext/gd/libgd/gd_gif_in.c?view=log
- 22538 third-party-advisory
- 21546 third-party-advisory
- 22440 third-party-advisory
- 20061005 rPSA-2006-0182-1 php php-mysql php-pgsql mailing-list
- oval:org.mitre.oval:def:9004 vdb-entry signature
- 22069 third-party-advisory
- ADV-2006-3318 vdb-entry
- 22225 third-party-advisory
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0046
- http://support.avaya.com/elmodocs2/security/ASA-2006-223.htm
- 28959 third-party-advisory
- MDVSA-2008:038 vendor-advisory
- RHSA-2008:0146 vendor-advisory
- http://www.php.net/ChangeLog-5.php#5.1.5
- 28838 third-party-advisory
- 20080212 FLEA-2008-0007-1 gd mailing-list
- 21842 third-party-advisory
- 28866 third-party-advisory
- SUSE-SR:2008:003 vendor-advisory
- http://bugs.php.net/bug.php?id=38112
- https://bugzilla.redhat.com/show_bug.cgi?id=431568
- SUSE-SR:2008:013 vendor-advisory
- SUSE-SA:2006:052 vendor-advisory
- 30717 third-party-advisory