CVE-2022-31630

OOB read due to insufficient input validation in imageloadfont()

State: Published
Severity: 6.5 Medium
Published: Nov 14, 2022
Updated: Aug 3, 2024
Reserved: May 25, 2022

Description

In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() function, the read outside allocated buffer will be used. This can lead to crashes or disclosure of confidential information.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L	php

Weaknesses

CWE-131 Incorrect Calculation of Buffer Size
CWE-190 Integer Overflow or Wraparound

Affected Products

Product	Versions
PHPPHP Group	7.4.x to before 7.4.33Affected 8.0.x to before 8.0.25Affected 8.1.x to before 8.1.12Affected

References

https://bugs.php.net/bug.php?id=81739

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.