cve/2014/CVE-2014-2497.md

CVE-2014-2497

Description

The gdImageCreateFromXpm function in gdxpm.c in libgd, as used in PHP 5.4.26 and earlier, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted color table in an XPM file.

POC

Reference

• http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
• https://bugs.php.net/bug.php?id=66901
• https://bugzilla.redhat.com/show_bug.cgi?id=1076676

Github

• https://github.com/Live-Hack-CVE/CVE-2014-2497