CVE-2006-4484 Memory corruption in n/a

Low 2.6 Published 31 Aug 2006 Updated 7 Aug 2024

Remote attackers can trigger a buffer overflow in the PHP GD extension by providing a malicious GIF file, potentially leading to code execution or denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2006-4484?

CVE-2006-4484 is a low-severity memory corruption vulnerability in Php Php, published on 31 Aug 2006. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Buffer overflow in the LWZReadByte_ function in ext/gd/libgd/gd_gif_in.c in the GD extension in PHP before 5.1.5 allows remote attackers to have an unknown impact via a GIF file with input_code_size greater than MAX_LWZ_BITS, which triggers an overflow when initializing the table array.

Which versions are affected by CVE-2006-4484?

It affects 1 product.

Linux distribution packages (1)

perl-Tk openSUSE:Tumbleweed All versions 804.033-1.10

Products include Php Php.

How do I fix CVE-2006-4484?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2006-4484 being exploited?

There is no known exploitation of CVE-2006-4484 in the wild and no public exploit code.

All Php Php vulnerabilities

Sources

Also known as DEBIAN-CVE-2006-4484, GHSA-6xv8-25r4-5mrf, openSUSE-SU-2024:10484-1.