Description
Multiple integer overflows in libgd in PHP before 5.2.4 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large (1) srcW or (2) srcH value to the (a) gdImageCopyResized function, or a large (3) sy (height) or (4) sx (width) value to the (b) gdImageCreate or the (c) gdImageCreateTrueColor function.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libgd2 | 2.0.35.dfsg-1 | — |
| Debian 14 | libwmf | No fix yet | — |
| Debian 14 | racket | 5.0.2-1 | — |
| Debian 13 | libgd2 | 2.0.35.dfsg-1 | — |
| Debian 13 | libwmf | No fix yet | — |
| Debian 13 | racket | 5.0.2-1 | — |
| Debian 12 | libgd2 | 2.0.35.dfsg-1 | — |
| Debian 12 | libwmf | No fix yet | — |
| Debian 12 | racket | 5.0.2-1 | — |
| Debian 4.0 | libgd2 | 2.0.33-5.2etch1 | DSA-1613-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | php +18 | 5.1.6-15.el5 | RHSA-2007:0890 |
| RHEL 4 | php +13 | 4.3.9-3.22.9 | RHSA-2007:0890 |
| RHEL 3 | php +6 | 4.3.2-43.ent | RHSA-2007:0889 |
| RHEL 2 | php +7 | 4.1.2-2.19 | RHSA-2007:0888 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Application Stack 2 | php +18 | 5.2.3-3.el5s2 | RHSA-2007:0917 |
| Red Hat Rhel Application Stack 1 | php +18 | 5.1.6-3.el4s1.8 | RHSA-2007:0891 |
Advisories 6
- RHSA-2007:0889 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0890 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0888 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1613-1 libgd2 - multiple vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2007:0917 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jan 14, 2026
- RHSA-2007:0891 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jan 14, 2026
References
- 26822 third-party-advisory
- GLSA-200712-13 vendor-advisory
- DSA-1613 vendor-advisory
- RHSA-2007:0888 vendor-advisory
- php-gdimagecreate-bo(36382) vdb-entry
- oval:org.mitre.oval:def:11147 vdb-entry signature
- SUSE-SA:2008:004 vendor-advisory
- 28658 third-party-advisory
- FEDORA-2007-709 vendor-advisory
- http://bugs.gentoo.org/show_bug.cgi?id=201546
- 26967 third-party-advisory
- 27351 third-party-advisory
- GLSA-200710-02 vendor-advisory
- 31168 third-party-advisory
- http://www.php.net/ChangeLog-5.php#5.2.4
- 26930 third-party-advisory
- 2007-0026 vendor-advisory
- RHSA-2007:0889 vendor-advisory
- http://secweb.se/en/advisories/php-imagecopyresized-integer-overflow/
- https://issues.rpath.com/browse/RPL-1693
- http://secweb.se/en/advisories/php-imagecreatetruecolor-integer-overflow/
- https://issues.rpath.com/browse/RPL-1702
- 27545 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2007-449.htm
- USN-557-1 vendor-advisory
- 26838 third-party-advisory
- 3103 third-party-advisory
- 27377 third-party-advisory
- 28009 third-party-advisory
- MDKSA-2007:187 vendor-advisory
- 27102 third-party-advisory
- ADV-2007-3023 vdb-entry
- http://www.php.net/releases/5_2_4.php
- 28147 third-party-advisory
- 26895 third-party-advisory
- RHSA-2007:0890 vendor-advisory
- RHSA-2007:0891 vendor-advisory
- 26871 third-party-advisory
- php-gdimagecopyresized-bo(36383) vdb-entry
- 26642 third-party-advisory