CVE-2009-3546 Memory corruption in n/a

Critical 9.3 Published 19 Oct 2009 Updated 7 Aug 2024

Remote attackers can trigger buffer overflows or over-reads via crafted GD files, potentially leading to code execution or denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2009-3546?

CVE-2009-3546 is a critical memory corruption vulnerability in Php Php, published on 19 Oct 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.x before 5.3.1, and the GD Graphics Library 2.x, does not properly verify a certain colorsTotal structure member, which might allow remote attackers to conduct buffer overflow or buffer over-read attacks via a crafted GD file, a different vulnerability than CVE-2009-3293. NOTE: some of these details are obtained from third party information.

Weakness: CWE-119

Which versions are affected by CVE-2009-3546?

It affects 2 products.

Linux distribution packages (26)

`gd` Red Hat:enterprise_linux:4::as	All versions	`0:2.0.28-5.4E.el4_8.1`
`gd-debuginfo` Red Hat:enterprise_linux:4::as	All versions	`0:2.0.28-5.4E.el4_8.1`
`gd-devel` Red Hat:enterprise_linux:4::as	All versions	`0:2.0.28-5.4E.el4_8.1`
`gd-progs` Red Hat:enterprise_linux:4::as	All versions	`0:2.0.28-5.4E.el4_8.1`
`gd` Red Hat:enterprise_linux:4::desktop	All versions	`0:2.0.28-5.4E.el4_8.1`
`gd-debuginfo` Red Hat:enterprise_linux:4::desktop	All versions	`0:2.0.28-5.4E.el4_8.1`
`gd-devel` Red Hat:enterprise_linux:4::desktop	All versions	`0:2.0.28-5.4E.el4_8.1`
`gd-progs` Red Hat:enterprise_linux:4::desktop	All versions	`0:2.0.28-5.4E.el4_8.1`
`gd` Red Hat:enterprise_linux:4::es	All versions	`0:2.0.28-5.4E.el4_8.1`
`gd-debuginfo` Red Hat:enterprise_linux:4::es	All versions	`0:2.0.28-5.4E.el4_8.1`
`gd-devel` Red Hat:enterprise_linux:4::es	All versions	`0:2.0.28-5.4E.el4_8.1`
`gd-progs` Red Hat:enterprise_linux:4::es	All versions	`0:2.0.28-5.4E.el4_8.1`
`gd` Red Hat:enterprise_linux:4::ws	All versions	`0:2.0.28-5.4E.el4_8.1`
`gd-debuginfo` Red Hat:enterprise_linux:4::ws	All versions	`0:2.0.28-5.4E.el4_8.1`
`gd-devel` Red Hat:enterprise_linux:4::ws	All versions	`0:2.0.28-5.4E.el4_8.1`
`gd-progs` Red Hat:enterprise_linux:4::ws	All versions	`0:2.0.28-5.4E.el4_8.1`
`gd` Red Hat:enterprise_linux:5::client	All versions	`0:2.0.33-9.4.el5_4.2`
`gd-debuginfo` Red Hat:enterprise_linux:5::client	All versions	`0:2.0.33-9.4.el5_4.2`
`gd-progs` Red Hat:enterprise_linux:5::client	All versions	`0:2.0.33-9.4.el5_4.2`
`gd` Red Hat:enterprise_linux:5::client_workstation	All versions	`0:2.0.33-9.4.el5_4.2`
`gd-debuginfo` Red Hat:enterprise_linux:5::client_workstation	All versions	`0:2.0.33-9.4.el5_4.2`
`gd-devel` Red Hat:enterprise_linux:5::client_workstation	All versions	`0:2.0.33-9.4.el5_4.2`
`gd` Red Hat:enterprise_linux:5::server	All versions	`0:2.0.33-9.4.el5_4.2`
`gd-debuginfo` Red Hat:enterprise_linux:5::server	All versions	`0:2.0.33-9.4.el5_4.2`
`gd-devel` Red Hat:enterprise_linux:5::server	All versions	`0:2.0.33-9.4.el5_4.2`
`gd-progs` Red Hat:enterprise_linux:5::server	All versions	`0:2.0.33-9.4.el5_4.2`

Products include Libgd Gd Graphics Library, Php Php.

How do I fix CVE-2009-3546?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2009-3546 being exploited?

There is no known exploitation of CVE-2009-3546 in the wild and no public exploit code.

All Php Php vulnerabilities

Sources

Also known as DEBIAN-CVE-2009-3546, GHSA-w7xp-2c87-fchc, RHSA-2010:0003, ROOT-OS-DEBIAN-12-CVE-2009-3546.