Vulnerabilities > CVE-2014-2497 - NULL Pointer Dereference vulnerability in multiple products
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN Summary
The gdImageCreateFromXpm function in gdxpm.c in libgd, as used in PHP 5.4.26 and earlier, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted color table in an XPM file.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Nessus
NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201607-04.NASL description The remote host is affected by the vulnerability described in GLSA-201607-04 (GD: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in GD. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could possibly execute arbitrary code with the privileges of the process, or cause a Denial of Service condition. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 92348 published 2016-07-18 reporter This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/92348 title GLSA-201607-04 : GD: Multiple vulnerabilities code # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Gentoo Linux Security Advisory GLSA 201607-04. # # The advisory text is Copyright (C) 2001-2016 Gentoo Foundation, Inc. # and licensed under the Creative Commons - Attribution / Share Alike # license. See http://creativecommons.org/licenses/by-sa/3.0/ # include("compat.inc"); if (description) { script_id(92348); script_version("2.3"); script_cvs_date("Date: 2019/04/11 17:23:06"); script_cve_id("CVE-2014-2497", "CVE-2014-9709", "CVE-2016-3074"); script_xref(name:"GLSA", value:"201607-04"); script_name(english:"GLSA-201607-04 : GD: Multiple vulnerabilities"); script_summary(english:"Checks for updated package(s) in /var/db/pkg"); script_set_attribute( attribute:"synopsis", value: "The remote Gentoo host is missing one or more security-related patches." ); script_set_attribute( attribute:"description", value: "The remote host is affected by the vulnerability described in GLSA-201607-04 (GD: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in GD. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could possibly execute arbitrary code with the privileges of the process, or cause a Denial of Service condition. Workaround : There is no known workaround at this time." ); script_set_attribute( attribute:"see_also", value:"https://security.gentoo.org/glsa/201607-04" ); script_set_attribute( attribute:"solution", value: "All GD users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose '>=media-libs/gd-2.2.2'" ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:gd"); script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux"); script_set_attribute(attribute:"patch_publication_date", value:"2016/07/16"); script_set_attribute(attribute:"plugin_publication_date", value:"2016/07/18"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Gentoo Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("qpkg.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo"); if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (qpkg_check(package:"media-libs/gd", unaffected:make_list("ge 2.2.2"), vulnerable:make_list("lt 2.2.2"))) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get()); else security_hole(0); exit(0); } else { tested = qpkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "GD"); }
NASL family Mandriva Local Security Checks NASL id MANDRIVA_MDVSA-2014-133.NASL description Updated gd and libgd packages fix security vulnerability : The gdImageCreateFromXpm function in gdxpm.c in the gd image library allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted color table in an XPM file (CVE-2014-2497). last seen 2020-06-01 modified 2020-06-02 plugin id 76469 published 2014-07-11 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/76469 title Mandriva Linux Security Advisory : gd (MDVSA-2014:133) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Mandriva Linux Security Advisory MDVSA-2014:133. # The text itself is copyright (C) Mandriva S.A. # include("compat.inc"); if (description) { script_id(76469); script_version("1.5"); script_cvs_date("Date: 2019/08/02 13:32:56"); script_cve_id("CVE-2014-2497"); script_bugtraq_id(66233); script_xref(name:"MDVSA", value:"2014:133"); script_name(english:"Mandriva Linux Security Advisory : gd (MDVSA-2014:133)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value: "The remote Mandriva Linux host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "Updated gd and libgd packages fix security vulnerability : The gdImageCreateFromXpm function in gdxpm.c in the gd image library allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted color table in an XPM file (CVE-2014-2497)." ); script_set_attribute( attribute:"see_also", value:"http://advisories.mageia.org/MGASA-2014-0288.html" ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:gd-utils"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64gd-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64gd-static-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64gd2"); script_set_attribute(attribute:"cpe", value:"cpe:/o:mandriva:business_server:1"); script_set_attribute(attribute:"patch_publication_date", value:"2014/07/10"); script_set_attribute(attribute:"plugin_publication_date", value:"2014/07/11"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Mandriva Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/Mandrake/release", "Host/Mandrake/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Mandrake/release")) audit(AUDIT_OS_NOT, "Mandriva / Mandake Linux"); if (!get_kb_item("Host/Mandrake/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if (cpu !~ "^(amd64|i[3-6]86|x86_64)$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Mandriva / Mandrake Linux", cpu); flag = 0; if (rpm_check(release:"MDK-MBS1", cpu:"x86_64", reference:"gd-utils-2.0.35-19.1.mbs1")) flag++; if (rpm_check(release:"MDK-MBS1", cpu:"x86_64", reference:"lib64gd-devel-2.0.35-19.1.mbs1")) flag++; if (rpm_check(release:"MDK-MBS1", cpu:"x86_64", reference:"lib64gd-static-devel-2.0.35-19.1.mbs1")) flag++; if (rpm_check(release:"MDK-MBS1", cpu:"x86_64", reference:"lib64gd2-2.0.35-19.1.mbs1")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");
NASL family Fedora Local Security Checks NASL id FEDORA_2014-8458.NASL description CVE-2014-2497 gd: NULL pointer dereference in : gdImageCreateFromXpm() Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2014-08-15 plugin id 77206 published 2014-08-15 reporter This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/77206 title Fedora 20 : gd-2.1.0-6.fc20 (2014-8458) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Fedora Security Advisory 2014-8458. # include("compat.inc"); if (description) { script_id(77206); script_version("1.5"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12"); script_cve_id("CVE-2014-2497"); script_bugtraq_id(66233); script_xref(name:"FEDORA", value:"2014-8458"); script_name(english:"Fedora 20 : gd-2.1.0-6.fc20 (2014-8458)"); script_summary(english:"Checks rpm output for the updated package."); script_set_attribute( attribute:"synopsis", value:"The remote Fedora host is missing a security update." ); script_set_attribute( attribute:"description", value: "CVE-2014-2497 gd: NULL pointer dereference in : gdImageCreateFromXpm() Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1076676" ); # https://lists.fedoraproject.org/pipermail/package-announce/2014-August/136491.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?af959355" ); script_set_attribute(attribute:"solution", value:"Update the affected gd package."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:gd"); script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:20"); script_set_attribute(attribute:"patch_publication_date", value:"2014/07/19"); script_set_attribute(attribute:"plugin_publication_date", value:"2014/08/15"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Fedora Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora"); os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora"); os_ver = os_ver[1]; if (! ereg(pattern:"^20([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 20.x", "Fedora " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu); flag = 0; if (rpm_check(release:"FC20", reference:"gd-2.1.0-6.fc20")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "gd"); }
NASL family Fedora Local Security Checks NASL id FEDORA_2014-9684.NASL description 21 Aug 2014, PHP 5.5.16 Core : - Fixed bug #67693 (incorrect push to the empty array) (Tjerk) - Fixed bug #67717 (segfault in dns_get_record). (CVE-2014-3597) (Remi) COM : - Fixed missing type checks in com_event_sink (Yussuf Khalil, Stas). Fileinfo : - Fixed bug #67705 (extensive backtracking in rule regular expression). (CVE-2014-3538) (Remi) - Fixed bug #67716 (Segfault in cdf.c). (CVE-2014-3587) (Remi) FPM : - Fixed bug #67635 (php links to systemd libraries without using pkg-config). (pacho at gentoo.org, Remi) GD : - Fixed bug #66901 (php-gd last seen 2020-03-17 modified 2014-09-03 plugin id 77482 published 2014-09-03 reporter This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/77482 title Fedora 20 : php-5.5.16-1.fc20 (2014-9684) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Fedora Security Advisory 2014-9684. # include("compat.inc"); if (description) { script_id(77482); script_version("1.5"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12"); script_cve_id("CVE-2012-1571", "CVE-2014-3587", "CVE-2014-5120"); script_bugtraq_id(52225, 69325, 69375); script_xref(name:"FEDORA", value:"2014-9684"); script_name(english:"Fedora 20 : php-5.5.16-1.fc20 (2014-9684)"); script_summary(english:"Checks rpm output for the updated package."); script_set_attribute( attribute:"synopsis", value:"The remote Fedora host is missing a security update." ); script_set_attribute( attribute:"description", value: "21 Aug 2014, PHP 5.5.16 Core : - Fixed bug #67693 (incorrect push to the empty array) (Tjerk) - Fixed bug #67717 (segfault in dns_get_record). (CVE-2014-3597) (Remi) COM : - Fixed missing type checks in com_event_sink (Yussuf Khalil, Stas). Fileinfo : - Fixed bug #67705 (extensive backtracking in rule regular expression). (CVE-2014-3538) (Remi) - Fixed bug #67716 (Segfault in cdf.c). (CVE-2014-3587) (Remi) FPM : - Fixed bug #67635 (php links to systemd libraries without using pkg-config). (pacho at gentoo.org, Remi) GD : - Fixed bug #66901 (php-gd 'c_color' NULL pointer dereference). (CVE-2014-2497) (Remi) - Fixed bug #67730 (Null byte injection possible with imagexxx functions). (CVE-2014-5120) (Ryan Mauger) Milter : - Fixed bug #67715 (php-milter does not build and crashes randomly). (Mike) OpenSSL : - Fixed missing type checks in OpenSSL options (Yussuf Khalil, Stas). readline : - Fixed bug #55496 (Interactive mode doesn't force a newline before the prompt). (Bob, Johannes) - Fixed bug #67496 (Save command history when exiting interactive shell with control-c). (Dmitry Saprykin, Johannes) Sessions : - Fixed missing type checks in php_session_create_id (Yussuf Khalil, Stas). ODBC : - Fixed bug #60616 (odbc_fetch_into returns junk data at end of multi-byte char fields). (Keyur) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1128587" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1132793" ); # https://lists.fedoraproject.org/pipermail/package-announce/2014-September/137191.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?0e61b474" ); script_set_attribute(attribute:"solution", value:"Update the affected php package."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:php"); script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:20"); script_set_attribute(attribute:"patch_publication_date", value:"2014/08/23"); script_set_attribute(attribute:"plugin_publication_date", value:"2014/09/03"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Fedora Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora"); os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora"); os_ver = os_ver[1]; if (! ereg(pattern:"^20([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 20.x", "Fedora " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu); flag = 0; if (rpm_check(release:"FC20", reference:"php-5.5.16-1.fc20")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "php"); }
NASL family SuSE Local Security Checks NASL id SUSE_11_APACHE2-MOD_PHP53-140627.NASL description php53 was updated to fix the following security vulnerabilities : - Heap-based buffer overflow in DNS TXT record parsing. (CVE-2014-4049) - Denial of service in Fileinfo component. (CVE-2014-0238) - Performance degradation by too many file_printf calls. (CVE-2014-0237) - NULL pointer dereference in GD XPM decoder. (CVE-2014-2497) last seen 2020-06-05 modified 2014-07-04 plugin id 76367 published 2014-07-04 reporter This script is Copyright (C) 2014-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/76367 title SuSE 11.3 Security Update : php53 (SAT Patch Number 9450) NASL family Huawei Local Security Checks NASL id EULEROS_SA-2019-1544.NASL description According to the versions of the php packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An integer underflow flaw leading to out-of-bounds memory access was found in the way PHP last seen 2020-06-01 modified 2020-06-02 plugin id 124997 published 2019-05-14 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124997 title EulerOS Virtualization 3.0.1.0 : php (EulerOS-SA-2019-1544) NASL family Mandriva Local Security Checks NASL id MANDRIVA_MDVSA-2014-172.NASL description Multiple vulnerabilities has been discovered and corrected in php : The gdImageCreateFromXpm function in gdxpm.c in libgd, as used in PHP 5.4.26 and earlier, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted color table in an XPM file (CVE-2014-2497). file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted file that triggers backtracking during processing of an awk rule. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7345 (CVE-2014-3538). Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a denial of service (application crash) via a crafted CDF file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1571 (CVE-2014-3587). Multiple buffer overflows in the php_parserr function in ext/standard/dns.c in PHP before 5.4.32 and 5.5.x before 5.5.16 allow remote DNS servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted DNS record, related to the dns_get_record function and the dn_expand function. NOTE: this issue exists because of an incomplete fix for CVE-2014-4049 (CVE-2014-3597). gd_ctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack \%00 sequences, which might allow remote attackers to overwrite arbitrary files via crafted input to an application that calls the (1) imagegd, (2) imagegd2, (3) imagegif, (4) imagejpeg, (5) imagepng, (6) imagewbmp, or (7) imagewebp function (CVE-2014-5120). The updated php packages have been upgraded to the 5.5.16 version resolve these security flaws. Additionally, php-apc has been rebuilt against the updated php packages and the php-timezonedb packages has been upgraded to the 2014.6 version. last seen 2020-06-01 modified 2020-06-02 plugin id 77651 published 2014-09-12 reporter This script is Copyright (C) 2014-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/77651 title Mandriva Linux Security Advisory : php (MDVSA-2014:172) NASL family CGI abuses NASL id PHP_5_6_0.NASL description According to its banner, the version of PHP installed on the remote host is a development version of 5.6.0. It is, therefore, affected by multiple vulnerabilities. Note that Nessus has not attempted to exploit this issue but has instead relied only on application last seen 2020-06-01 modified 2020-06-02 plugin id 78556 published 2014-10-17 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/78556 title PHP 5.6.0 Multiple Vulnerabilities NASL family Mandriva Local Security Checks NASL id MANDRIVA_MDVSA-2015-153.NASL description Updated libgd packages fix security vulnerabilities : The gdImageCreateFromXpm function in gdxpm.c in the gd image library allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted color table in an XPM file (CVE-2014-2497). A buffer read overflow in gd_gif_in.c in the php#68601 bug referenced in the PHP 5.5.21 ChangeLog has been fixed in the libgd package. last seen 2020-06-01 modified 2020-06-02 plugin id 82406 published 2015-03-30 reporter This script is Copyright (C) 2015-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/82406 title Mandriva Linux Security Advisory : libgd (MDVSA-2015:153) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-3215.NASL description Multiple vulnerabilities were discovered in libgd2, a graphics library : - CVE-2014-2497 The gdImageCreateFromXpm() function would try to dereference a NULL pointer when reading an XPM file with a special color table. This could allow remote attackers to cause a denial of service (crash) via crafted XPM files. - CVE-2014-9709 Importing an invalid GIF file using the gdImageCreateFromGif() function would cause a read buffer overflow that could allow remote attackers to cause a denial of service (crash) via crafted GIF files. last seen 2020-03-17 modified 2015-04-08 plugin id 82623 published 2015-04-08 reporter This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/82623 title Debian DSA-3215-1 : libgd2 - security update NASL family MacOS X Local Security Checks NASL id MACOSX_SECUPD2015-004.NASL description The remote host is running a version of Mac OS X 10.8.5 or 10.9.5 that is missing Security Update 2015-004. It is, therefore, affected multiple vulnerabilities in the following components : - Apache - ATS - Certificate Trust Policy - CoreAnimation - FontParser - Graphics Driver - ImageIO - IOHIDFamily - Kernel - LaunchServices - Open Directory Client - OpenLDAP - OpenSSL - PHP - QuickLook - SceneKit - Security - Code SIgning - UniformTypeIdentifiers Note that successful exploitation of the most serious issues can result in arbitrary code execution. last seen 2020-06-01 modified 2020-06-02 plugin id 82700 published 2015-04-10 reporter This script is Copyright (C) 2015-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/82700 title Mac OS X Multiple Vulnerabilities (Security Update 2015-004) (FREAK) NASL family Scientific Linux Local Security Checks NASL id SL_20140930_PHP53_AND_PHP_ON_SL5_X.NASL description It was found that the fix for CVE-2012-1571 was incomplete; the File Information (fileinfo) extension did not correctly parse certain Composite Document Format (CDF) files. A remote attacker could use this flaw to crash a PHP application using fileinfo via a specially crafted CDF file. (CVE-2014-3587) A NULL pointer dereference flaw was found in the gdImageCreateFromXpm() function of PHP last seen 2020-03-18 modified 2014-10-14 plugin id 78419 published 2014-10-14 reporter This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/78419 title Scientific Linux Security Update : php53 and php on SL5.x, SL6.x i386/x86_64 (20140930) NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2014-1326.NASL description Updated php53 and php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6 respectively. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. PHP last seen 2020-06-01 modified 2020-06-02 plugin id 77995 published 2014-10-01 reporter This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/77995 title CentOS 5 / 6 : php / php53 (CESA-2014:1326) NASL family SuSE Local Security Checks NASL id SUSE_SU-2014-0868-1.NASL description PHP5 has been updated to fix two security vulnerabilities : - Heap-based buffer overflow in DNS TXT record parsing (CVE-2014-4049) - NULL pointer dereference in GD XPM decoder (CVE-2014-2497) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-05 modified 2015-05-20 plugin id 83630 published 2015-05-20 reporter This script is Copyright (C) 2015-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/83630 title SUSE SLES11 Security Update : PHP5 (SUSE-SU-2014:0868-1) NASL family Fedora Local Security Checks NASL id FEDORA_2015-0432.NASL description Previous patch of #1076676 introduced memory leak. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-05 modified 2015-01-20 plugin id 80837 published 2015-01-20 reporter This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/80837 title Fedora 21 : gd-2.1.0-8.fc21 (2015-0432) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2014-1327.NASL description Updated php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. PHP last seen 2020-06-01 modified 2020-06-02 plugin id 78009 published 2014-10-01 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/78009 title RHEL 7 : php (RHSA-2014:1327) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2014-1326.NASL description From Red Hat Security Advisory 2014:1326 : Updated php53 and php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6 respectively. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. PHP last seen 2020-06-01 modified 2020-06-02 plugin id 78004 published 2014-10-01 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/78004 title Oracle Linux 5 / 6 : php / php53 (ELSA-2014-1326) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-2987-1.NASL description It was discovered that the GD library incorrectly handled certain color tables in XPM images. If a user or automated system were tricked into processing a specially crafted XPM image, an attacker could cause a denial of service. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-2497) It was discovered that the GD library incorrectly handled certain malformed GIF images. If a user or automated system were tricked into processing a specially crafted GIF image, an attacker could cause a denial of service. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-9709) It was discovered that the GD library incorrectly handled memory when using gdImageFillToBorder(). A remote attacker could possibly use this issue to cause a denial of service. (CVE-2015-8874) It was discovered that the GD library incorrectly handled memory when using gdImageScaleTwoPass(). A remote attacker could possibly use this issue to cause a denial of service. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 15.10 and Ubuntu 16.04 LTS. (CVE-2015-8877) Hans Jerry Illikainen discovered that the GD library incorrectly handled certain malformed GD images. If a user or automated system were tricked into processing a specially crafted GD image, an attacker could cause a denial of service or possibly execute arbitrary code. (CVE-2016-3074). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 91423 published 2016-06-01 reporter Ubuntu Security Notice (C) 2016-2019 Canonical, Inc. / NASL script (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/91423 title Ubuntu 12.04 LTS / 14.04 LTS / 15.10 / 16.04 LTS : libgd2 vulnerabilities (USN-2987-1) NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2014-1327.NASL description Updated php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. PHP last seen 2020-06-01 modified 2020-06-02 plugin id 77996 published 2014-10-01 reporter This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/77996 title CentOS 7 : php (CESA-2014:1327) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2014-1327.NASL description From Red Hat Security Advisory 2014:1327 : Updated php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. PHP last seen 2020-06-01 modified 2020-06-02 plugin id 78005 published 2014-10-01 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/78005 title Oracle Linux 7 : php (ELSA-2014-1327) NASL family SuSE Local Security Checks NASL id OPENSUSE-2014-419.NASL description php5 was updated to fix several security issues. These issues were fixed : - Performance degradation by too many file_printf calls (CVE-2014-0237) - DoS in Fileinfo component (CVE-2014-0238) - NULL pointer dereference in GD XPM decoder (CVE-2014-2497) - Privilege escalation due to insecure default config (CVE-2014-0185) last seen 2020-06-05 modified 2014-06-13 plugin id 75385 published 2014-06-13 reporter This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/75385 title openSUSE Security Update : php5 (openSUSE-SU-2014:0784-1) NASL family Slackware Local Security Checks NASL id SLACKWARE_SSA_2014-247-01.NASL description New php packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues. last seen 2020-06-01 modified 2020-06-02 plugin id 77543 published 2014-09-05 reporter This script is Copyright (C) 2014 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/77543 title Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : php (SSA:2014-247-01) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2014-1326.NASL description Updated php53 and php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6 respectively. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. PHP last seen 2020-06-01 modified 2020-06-02 plugin id 77980 published 2014-09-30 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/77980 title RHEL 5 / 6 : php53 and php (RHSA-2014:1326) NASL family Fedora Local Security Checks NASL id FEDORA_2014-9679.NASL description 21 Aug 2014, PHP 5.5.16 Core : - Fixed bug #67693 (incorrect push to the empty array) (Tjerk) - Fixed bug #67717 (segfault in dns_get_record). (CVE-2014-3597) (Remi) COM : - Fixed missing type checks in com_event_sink (Yussuf Khalil, Stas). Fileinfo : - Fixed bug #67705 (extensive backtracking in rule regular expression). (CVE-2014-3538) (Remi) - Fixed bug #67716 (Segfault in cdf.c). (CVE-2014-3587) (Remi) FPM : - Fixed bug #67635 (php links to systemd libraries without using pkg-config). (pacho at gentoo.org, Remi) GD : - Fixed bug #66901 (php-gd last seen 2020-03-17 modified 2014-09-03 plugin id 77481 published 2014-09-03 reporter This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/77481 title Fedora 19 : php-5.5.16-1.fc19 (2014-9679) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201408-11.NASL description The remote host is affected by the vulnerability described in GLSA-201408-11 (PHP: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below for details. Impact : A context-dependent attacker can cause arbitrary code execution, create a Denial of Service condition, read or write arbitrary files, impersonate other servers, hijack a web session, or have other unspecified impact. Additionally, a local attacker could gain escalated privileges. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 77455 published 2014-08-30 reporter This script is Copyright (C) 2014-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/77455 title GLSA-201408-11 : PHP: Multiple vulnerabilities NASL family Debian Local Security Checks NASL id DEBIAN_DLA-189.NASL description Multiple vulnerabilities were discovered in libgd2, a graphics library : CVE-2014-2497 The gdImageCreateFromXpm() function would try to dereference a NULL pointer when reading an XPM file with a special color table. This could allow remote attackers to cause a denial of service (crash) via crafted XPM files. CVE-2014-9709 Importing an invalid GIF file using the gdImageCreateFromGif() function would cause a read buffer overflow that could allow remote attackers to cause a denial of service (crash) via crafted GIF files. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2015-04-09 plugin id 82646 published 2015-04-09 reporter This script is Copyright (C) 2015-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/82646 title Debian DLA-189-1 : libgd2 security update NASL family MacOS X Local Security Checks NASL id MACOSX_10_10_3.NASL description The remote host is running a version of Mac OS X 10.10.x that is prior to 10.10.3. It is, therefore, affected multiple vulnerabilities in the following components : - Admin Framework - Apache - ATS - Certificate Trust Policy - CFNetwork HTTPProtocol - CFNetwork Session - CFURL - CoreAnimation - FontParser - Graphics Driver - Hypervisor - ImageIO - IOHIDFamily - Kernel - LaunchServices - libnetcore - ntp - Open Directory Client - OpenLDAP - OpenSSL - PHP - QuickLook - SceneKit - ScreenSharing - Security - Code SIgning - UniformTypeIdentifiers - WebKit Note that successful exploitation of the most serious issues can result in arbitrary code execution. last seen 2020-06-01 modified 2020-06-02 plugin id 82699 published 2015-04-10 reporter This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/82699 title Mac OS X 10.10.x < 10.10.3 Multiple Vulnerabilities (FREAK) NASL family Fedora Local Security Checks NASL id FEDORA_2015-0503.NASL description Previous patch of #1076676 introduced memory leak. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-05 modified 2015-01-21 plugin id 80873 published 2015-01-21 reporter This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/80873 title Fedora 20 : gd-2.1.0-8.fc20 (2015-0503) NASL family CGI abuses NASL id PHP_5_5_16.NASL description According to its banner, the remote web server is running a version of PHP 5.5.x prior to 5.5.16. It is, therefore, affected by the following vulnerabilities : - LibGD contains a NULL pointer dereference flaw in its last seen 2020-06-01 modified 2020-06-02 plugin id 77403 published 2014-08-27 reporter This script is Copyright (C) 2014-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/77403 title PHP 5.5.x < 5.5.16 Multiple Vulnerabilities NASL family Amazon Linux Local Security Checks NASL id ALA_ALAS-2014-415.NASL description A denial of service flaw was found in the way the File Information (fileinfo) extension parsed certain Composite Document Format (CDF) files. A remote attacker could use this flaw to crash a PHP application using fileinfo via a specially crafted CDF file. gd_ctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to overwrite arbitrary files via crafted input to an application that calls the (1) imagegd, (2) imagegd2, (3) imagegif, (4) imagejpeg, (5) imagepng, (6) imagewbmp, or (7) imagewebp function. The gdImageCreateFromXpm function in gdxpm.c in libgd, as used in PHP 5.4.26 and earlier, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted color table in an XPM file. Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a denial of service (application crash) via a crafted CDF file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1571 . last seen 2020-06-01 modified 2020-06-02 plugin id 78358 published 2014-10-12 reporter This script is Copyright (C) 2014-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/78358 title Amazon Linux AMI : php55 (ALAS-2014-415) NASL family CGI abuses NASL id PHP_5_4_32.NASL description According to its banner, the remote web server is running a version of PHP 5.4.x prior to 5.4.32. It is, therefore, affected by the following vulnerabilities : - LibGD contains a NULL pointer dereference flaw in its last seen 2020-06-01 modified 2020-06-02 plugin id 77402 published 2014-08-27 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/77402 title PHP 5.4.x < 5.4.32 Multiple Vulnerabilities
Redhat
advisories |
| ||||||||||||||||
rpms |
|
Seebug
bulletinFamily exploit description CVE ID: CVE-2014-2497 PHP是一种HTML内嵌式的语言。 PHP 5.4.26、5.5.10版本在 "gdImageCreateFromXpm()" 函数 (ext/gd/libgd/gdxpm.c)的实现上存在空指针间接引用错误,攻击者通过特制的XPM文件,利用此漏洞可造成崩溃。 0 PHP PHP 5.5.10 PHP PHP 5.4.26 目前厂商还没有提供补丁或者升级程序,我们建议使用此软件的用户随时关注厂商的主页以获取最新版本: http://www.php.net/downloads.php https://bugs.php.net/bug.php?id=66901 id SSV:61842 last seen 2017-11-19 modified 2014-03-19 published 2014-03-19 reporter Root title PHP "gdImageCreateFromXpm()"空指针间接引用漏洞 bulletinFamily exploit description Bugtraq ID:66233 CVE ID:CVE-2014-2497 php-gd是一个图片处理扩展库。 php-gd 'gdxpm.c'中的gdImageCreateFromXpm()函数存在安全漏洞,调用strlen()解析image.colorTable[i].c_color时存在空指针引用错误,允许攻击者利用漏洞使链接此库的应用崩溃。 0 php-gd <= v5.4.17-2 目前没有详细解决方案提供: http://www.php.net/ id SSV:61811 last seen 2017-11-19 modified 2014-03-17 published 2014-03-17 reporter Root source https://www.seebug.org/vuldb/ssvid-61811 title php-gd 'gdxpm.c'空指针拒绝服务漏洞
References
- https://bugs.php.net/bug.php?id=66901
- https://bugzilla.redhat.com/show_bug.cgi?id=1076676
- http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00001.html
- http://secunia.com/advisories/59652
- http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00002.html
- http://rhn.redhat.com/errata/RHSA-2014-1327.html
- http://rhn.redhat.com/errata/RHSA-2014-1326.html
- http://rhn.redhat.com/errata/RHSA-2014-1766.html
- http://rhn.redhat.com/errata/RHSA-2014-1765.html
- https://support.apple.com/HT204659
- http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html
- http://www.debian.org/security/2015/dsa-3215
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:153
- http://advisories.mageia.org/MGASA-2014-0288.html
- http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
- https://security.gentoo.org/glsa/201607-04
- http://www.securityfocus.com/bid/66233
- http://www.ubuntu.com/usn/USN-2987-1
- http://secunia.com/advisories/59496
- http://secunia.com/advisories/59418
- http://secunia.com/advisories/59061