ALPINE-CVE-2017-7890
- Source
- https://security.alpinelinux.org/vuln/CVE-2017-7890
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2017-7890.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/ALPINE-CVE-2017-7890
- Upstream
- Published
- 2017-08-02T19:29:00Z
- Modified
- 2025-09-25T23:56:45.511572Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- [none]
- Details
-
The GIF decoding function gdImageCreateFromGifCtx in gdgifin.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.31 and 7.x before 7.1.7, does not zero colorMap arrays before use. A specially crafted GIF image could use the uninitialized tables to read ~700 bytes from the top of the stack, potentially disclosing sensitive information.
- References
Affected packages
Alpine:v3.4 / gd
Package
- Name
- gd
- Purl
- pkg:apk/alpine/gd?arch=source
Alpine:v3.5 / gd
Package
- Name
- gd
- Purl
- pkg:apk/alpine/gd?arch=source