Information disclosure in PHP - CVE-2017-7890

Vulnerability identifier: #VU11789

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-7890

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists in the GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c due to it does not zero colorMap arrays before use. A remote attacker can trick the victim into opening a specially crafted GIF image that could use the uninitialized tables to read ~700 bytes from the top of the stack and gain access to potentially sensitive information.

PHP
Debian Linux
Amazon Linux AMI
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power
Ubuntu
Slackware Linux
Fedora
gd (Alpine package)
php7 (Alpine package)
gd

Update to versions 5.6.31 or 7.1.7.

gd (Alpine package) - update to 2.2.5-r0
php7 (Alpine package) - update to 7.1.10-r0
gd - addressed in versions 2.2.5-1.fc25, 2.2.5-1.fc26, 2.2.5-1.fc27

• http://php.net/ChangeLog-5.php

• Ubuntu update for GD
• Ubuntu update for LibGD
• Debian update for libgd2
• Amazon Linux AMI update for php70
• Slackware Linux update for gd
• Red Hat update for php
• Red Hat update for php
• Information disclosure in php7 (Alpine package)
• Information disclosure in gd (Alpine package)
• Fedora 27 update for gd
• Fedora 25 update for gd
• Fedora 26 update for gd