Bug 1297717 (CVE-2016-1903) - CVE-2016-1903 php: Out-of-bounds memory read via gdImageRotateInterpolated
Summary: CVE-2016-1903 php: Out-of-bounds memory read via gdImageRotateInterpolated
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2016-1903
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1297718
Blocks: 1297732
TreeView+ depends on / blocked
 
Reported: 2016-01-12 10:06 UTC by Adam Mariš
Modified: 2019-12-16 05:16 UTC (History)
16 users (show)

Fixed In Version: php 5.5.31, php 5.6.17
Clone Of:
Environment:
Last Closed: 2016-02-03 13:03:37 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:2750 0 normal SHIPPED_LIVE Moderate: rh-php56 security, bug fix, and enhancement update 2016-11-15 16:40:02 UTC

Description Adam Mariš 2016-01-12 10:06:15 UTC
In function:

resource imagerotate ( resource $image , float $angle , int $bgd_color [, int $ignore_transparent = 0 ] )

$bgd_color specifies the background color of an image. This is passed in as an integer that represents an index to the color palette. It was found that there is a lack of validation on $bgd_color. One can pass in a large number that exceeds the color palette array, which results in out-of-bounds memory read beyond the color palette. Information of the memory leak can then be obtained via the background color after the image has been rotated.

Upstream patches:

-> original fix
https://github.com/php/php-src/commit/4bb422343f29f06b7081323844d9b52e1a71e4a5
-> improvement
https://github.com/php/php-src/commit/2baeb167a08b0186a885208bdc8b5871f1681dc8
-> final correction, includes the reverse of the 2 above :
https://github.com/php/php-src/commit/aa8d3a8cc612ba87c0497275f58a2317a90fb1c4

Upstream bug (contains reproducer):

https://bugs.php.net/bug.php?id=70976

Comment 1 Adam Mariš 2016-01-12 10:06:48 UTC
Created php tracking bugs for this issue:

Affects: fedora-all [bug 1297718]

Comment 2 Remi Collet 2016-01-12 11:56:58 UTC
This issue only affects PHP 5.5+ with bundled libgd >= 2.1

So it doesn't affects PHP 5.3 (RHEL-6) OR php 5.4 (RHEL-7)

Comment 7 errata-xmlrpc 2016-11-15 11:49:11 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS

Via RHSA-2016:2750 https://rhn.redhat.com/errata/RHSA-2016-2750.html


Note You need to log in before you can comment on or make changes to this bug.