6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
8.3 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
34.3%
In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() function, the read outside allocated buffer will be used. This can lead to crashes or disclosure of confidential information.
[
{
"defaultStatus": "unaffected",
"modules": [
"gd"
],
"product": "PHP",
"repo": "https://github.com/php/php-src",
"vendor": "PHP Group",
"versions": [
{
"lessThan": "7.4.33",
"status": "affected",
"version": "7.4.x",
"versionType": "custom"
},
{
"lessThan": "8.0.25",
"status": "affected",
"version": "8.0.x",
"versionType": "custom"
},
{
"lessThan": "8.1.12",
"status": "affected",
"version": "8.1.x",
"versionType": "custom"
}
]
}
]
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
8.3 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
34.3%