title: OOB read due to insufficient input validation in imageloadfont()
description: In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() function, the read outside allocated buffer will be used. This can lead to crashes or disclosure of confidential information.
problem types: CWE-131 Incorrect Calculation of Buffer Size
affected:
{
defaultStatus: unaffected
modules: gd
product: PHP
repo: https://github.com/php/php-src
vendor: PHP Group
versions:
lessThan: 7.4.33, status: affected, version: 7.4.x, versionType: custom
lessThan: 8.0.25, status: affected, version: 8.0.x, versionType: custom
lessThan: 8.1.12, status: affected, version: 8.1.x, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
version: 3.1
]
format: CVSS
scenarios: GENERAL