Vulnerabilities > CVE-2013-7328 - Numeric Errors vulnerability in PHP

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN
php
CWE-189
nessus
NVD
Published: 2014-02-18
Updated: 2024-11-21

Summary

Multiple integer signedness errors in the gdImageCrop function in ext/gd/gd.c in PHP 5.5.x before 5.5.9 allow remote attackers to cause a denial of service (application crash) or obtain sensitive information via an imagecrop function call with a negative value for the (1) x or (2) y dimension, a different vulnerability than CVE-2013-7226.

Vulnerable Configurations

Part Description Count
Application
Php
21

Common Weakness Enumeration (CWE)

Nessus

  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-2126-1.NASL
    descriptionBernd Melchers discovered that PHP
    last seen2020-03-18
    modified2014-03-04
    plugin id72799
    published2014-03-04
    reporterUbuntu Security Notice (C) 2014-2020 Canonical, Inc. / NASL script (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/72799
    titleUbuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.10 : php5 vulnerabilities (USN-2126-1)
  • NASL familyCGI abuses
    NASL idPHP_5_5_9.NASL
    descriptionAccording to its banner, the version of PHP 5.5.x installed on the remote host is a version prior to 5.5.9. It is, therefore, potentially affected by the following vulnerabilities related to the GD extension : - A heap-based buffer overflow error exists related to the functions
    last seen2020-06-01
    modified2020-06-02
    plugin id72511
    published2014-02-14
    reporterThis script is Copyright (C) 2014-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/72511
    titlePHP 5.5.x < 5.5.9 GD Extension Multiple Vulnerabilities

Seebug

bulletinFamilyexploit
descriptionCVE ID:CVE-2013-7328 PHP是一种HTML内嵌式的语言。 PHP 'ext/gd/gd.c' gdImageCrop函数存在多个整数符号错误，允许远程攻击者通过调用x或Y维度为负值的imagecrop函数，可使应用程序崩溃或获取敏感信息。 0 PHP 5.5.x PHP 5.5.9已经修复该漏洞，建议用户下载更新： http://php.net
idSSV:61499
last seen2017-11-19
modified2014-02-20
published2014-02-20
reporterRoot
titlePHP 'ext/gd/gd.c' gdImageCrop整数符号错误漏洞

References