FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2008-5498

This CVE name corresponds to:

Entered	Topic
2009-01-05	php5-gd -- uninitialized memory information disclosure vulnerability

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2008-5498 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2008-5498
Phase	Assigned(20081212)

Description

Array index error in the imageRotate function in PHP 5.2.8 and earlier allows context-dependent attackers to read the contents of arbitrary memory locations via a crafted value of the third argument (aka the bgd_color or clrBack argument) for an indexed image.

References

Source	Reference
MISC	http://downloads.securityfocus.com/vulnerabilities/exploits/33002-2.php
MISC	http://downloads.securityfocus.com/vulnerabilities/exploits/33002.php
CONFIRM	http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.2027.2.547.2.1360&r2=1.2027.2.547.2.1361&diff_format=u
CONFIRM	http://www.php.net/releases/5_2_9.php
CONFIRM	http://support.apple.com/kb/HT3865
APPLE	APPLE-SA-2009-09-10-2
FEDORA	FEDORA-2009-3768
FEDORA	FEDORA-2009-3848
HP	HPSBUX02431
HP	SSRT090085
HP	HPSBUX02465
HP	SSRT090192
MANDRIVA	MDVSA-2009:021
MANDRIVA	MDVSA-2009:022
MANDRIVA	MDVSA-2009:023
REDHAT	RHSA-2009:0350
SUSE	SUSE-SR:2009:008
BID	33002
OSVDB	51031
OVAL	oval:org.mitre.oval:def:9667
SECTRACK	1021494
SECUNIA	34642
SECUNIA	35306
SECUNIA	35650
SECUNIA	36701
XF	php-imagerotate-info-disclosure(47635)