Buffer overflow in the gdImageStringFTEx function in gdft.c in the GD Graphics Library 2.0.33 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted string with a JIS encoded font.

Tetex 3.x uses an embedded copy of the gd source and may also be affected by this issue (CVE-2007-0455).

A buffer overflow in the open_sty function for makeindex in Tetex could allow user-assisted remote attackers to overwrite files and possibly execute arbitrary code via a long filename (CVE-2007-0650).

The updated packages have been patched to prevent these issues.

Buffer overflow in the gdImageStringFTEx function in gdft.c in the GD Graphics Library 2.0.33 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted string with a JIS encoded font.

Libwmf uses an embedded copy of the gd source and may also be affected by this issue.

Packages have been patched to correct this issue.

- Mon Dec 6 2010 Caolan McNamara <caolanm at redhat.com> -     0.2.8.4-22

    - Resolves: rhbz#660161 security issues

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated PHP packages that fix several security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server.

A flaw was found in the way the mbstring extension set global variables. A script which used the mb_parse_str() function to set global variables could be forced to enable the register_globals configuration option, possibly resulting in global variable injection.
(CVE-2007-1583)

A heap based buffer overflow flaw was discovered in PHP's gd extension. A script that could be forced to process WBMP images from an untrusted source could result in arbitrary code execution.
(CVE-2007-1001)

A buffer over-read flaw was discovered in PHP's gd extension. A script that could be forced to write arbitrary string using a JIS font from an untrusted source could cause the PHP interpreter to crash.
(CVE-2007-0455)

A flaw was discovered in the way PHP's mail() function processed header data. If a script sent mail using a Subject header containing a string from an untrusted source, a remote attacker could send bulk e-mail to unintended recipients. (CVE-2007-1718)

Users of PHP should upgrade to these updated packages which contain backported patches to correct these issues.

The remote BIG-IP device is missing a patch required by a security advisory.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - gd: additional overflows (CVE-2004-0941)

  - libwmf: Memory allocation failure in wmf_malloc (CVE-2016-9011)

  - Buffer overflow in the gdImageStringFTEx function in gdft.c in GD Graphics Library 2.0.33 and earlier     allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary     code via a crafted string with a JIS encoded font. (CVE-2007-0455)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote host is running a version of PHP lower than 4.4.7 or 5.2.2.  This version is vulnerable to a number of remote issues.  At least one of these issues is related to a buffer overflow attack.  An attacker exploiting these flaws would be able to impact confidentiality, integrity, and availability. 

ID	Name	Product	Family	Published	Updated	Severity
25311	Mandrake Linux Security Advisory : tetex (MDKSA-2007:109)	Nessus	Mandriva Local Security Checks	5/25/2007	1/6/2021	high
24649	Mandrake Linux Security Advisory : libwmf (MDKSA-2007:036)	Nessus	Mandriva Local Security Checks	2/18/2007	1/6/2021	high
51414	Fedora 13 : libwmf-0.2.8.4-22.fc13 (2010-19022)	Nessus	Fedora Local Security Checks	1/5/2011	1/11/2021	high
25325	RHEL 5 : php (RHSA-2007:0153)	Nessus	Red Hat Local Security Checks	5/25/2007	1/14/2021	high
78215	F5 Networks BIG-IP : Multiple PHP vulnerabilities (SOL7859)	Nessus	F5 Networks Local Security Checks	10/10/2014	1/11/2021	high
198368	RHEL 6 : libwmf (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	6/3/2024	medium
3982	PHP 4.x < 4.4.7 / 5.x < 5.2.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	5/4/2007	3/6/2019	high
801085	PHP < 4.4.7 / 5.2.2 Multiple Vulnerabilities	Log Correlation Engine	Web Servers			high

Detections

Analytics

Plugins Search

high

high

high

high

high

medium

high

high