CVE-2007-0455 · threatengine.sh

Home/CVE/Buffer overflow in the gdImageStringFTEx function in gdft.c in GD Graphics Library 2.0.33 and earlier allows remote atta

CVE

CVE-2007-0455

Buffer overflow in the gdImageStringFTEx function in gdft.c in GD Graphics Library 2.0.33 and earlier allows remote atta

Buffer overflow in the gdImageStringFTEx function in gdft.c in GD Graphics Library 2.0.33 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted string with a JIS encoded font.

HIGH · CVSS 7.5 EPSS 0.05488

Schedule remediation

EPSS percentile: top 10% of all CVEs by exploitation likelihood
CVSS base score ≥ 7.0

Sigma rules0 YARA rules0

⬡

Weakness Classification

CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

▤

Affected Products & Versions

7

gd graphics library project gd graphics library<= 2.0.33
php>= 4.4.0 and < 4.4.7
canonical ubuntu linuxall versions
fedoraproject fedoraall versions
redhat enterprise linux desktopall versions
redhat enterprise linux serverall versions
redhat enterprise linux workstationall versions

▣

Scoring & Timeline

7.5

HIGH · CVSS v2 (legacy) · secalert@redhat.com

View on NVD

This CVE predates CVSS v3; the legacy v2 score is shown so triage still has a severity to work with.

v2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Published to NVD30 Jan 2007 · 05:28 PM

⚑

Vendor Advisories

5

rhsaRHSA-2008:0146Low
usnUSN-473-1
rhsaRHSA-2007:0153Low
rhsaRHSA-2007:0162Low
rhsaRHSA-2007:0155Low

🔗

References & Sources

35

Source URLs (vendor pages, mailing lists, write-ups). Exploit/PoC links are in their own section above to avoid duplication.

http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=224607Issue TrackingThird Party Advisory

http://fedoranews.org/cms/node/2631Broken Link

http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052848.htmlMailing ListThird Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052854.htmlMailing ListThird Party Advisory

http://lists.rpath.com/pipermail/security-announce/2007-February/000145.htmlBroken Link

http://rhn.redhat.com/errata/RHSA-2007-0155.htmlThird Party Advisory

Show all 35 references

http://secunia.com/advisories/23916Not ApplicableVendor Advisory

http://secunia.com/advisories/24022Not Applicable

http://secunia.com/advisories/24052Not Applicable

http://secunia.com/advisories/24053Not Applicable

http://secunia.com/advisories/24107Not Applicable

http://secunia.com/advisories/24143Not Applicable

http://secunia.com/advisories/24151Not Applicable

http://secunia.com/advisories/24924Not Applicable

http://secunia.com/advisories/24945Not Applicable

http://secunia.com/advisories/24965Not Applicable

http://secunia.com/advisories/25575Not Applicable

http://secunia.com/advisories/29157Not Applicable

http://secunia.com/advisories/42813Not Applicable

http://www.mandriva.com/security/advisories?name=MDKSA-2007:035Broken Link

http://www.mandriva.com/security/advisories?name=MDKSA-2007:036Broken Link

http://www.mandriva.com/security/advisories?name=MDKSA-2007:038Broken Link

http://www.mandriva.com/security/advisories?name=MDKSA-2007:109Broken Link

http://www.redhat.com/support/errata/RHSA-2007-0153.htmlThird Party Advisory

http://www.redhat.com/support/errata/RHSA-2007-0162.htmlThird Party Advisory

http://www.redhat.com/support/errata/RHSA-2008-0146.htmlThird Party Advisory

http://www.securityfocus.com/archive/1/466166/100/0/threadedThird Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/22289Third Party AdvisoryVDB Entry

http://www.trustix.org/errata/2007/0007Broken Link

http://www.ubuntu.com/usn/usn-473-1Third Party Advisory

http://www.vupen.com/english/advisories/2007/0400Permissions Required

http://www.vupen.com/english/advisories/2011/0022Permissions Required

https://issues.rpath.com/browse/RPL-1030Broken Link

https://issues.rpath.com/browse/RPL-1268Broken Link

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11303Third Party Advisory

Intelligence Graph · click any node to traverse

CVETechnique ActorTool Family

drag to reposition · click any node to traverse · button top-right enlarges

External lookups - second-class, for what we don’t hold ourselves

NVD CVE.org CISA Vulners Exploit-DB GitHub PoC VulnCheck KEV GreyNoise

Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities

Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs

Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures

Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1

About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service

threatengine.sh · Open-source threat intelligence platform · 100+ authoritative sources · Every fact traces to its origin