Vulnerability Database

289,599

Total vulnerabilities in the database

CVE-2009-3546

The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.x before 5.3.1, and the GD Graphics Library 2.x, does not properly verify a certain colorsTotal structure member, which might allow remote attackers to conduct buffer overflow or buffer over-read attacks via a crafted GD file, a different vulnerability than CVE-2009-3293. NOTE: some of these details are obtained from third party information.

  • Published: Oct 19, 2009
  • Updated: Apr 13, 2023
  • CVE: CVE-2009-3546
  • Severity: High
  • Exploit:

CVSS v2:

  • Severity: High
  • Score: 9.3
  • AV:N/AC:M/Au:N/C:C/I:C/A:C

CWEs:

Software From Fixed in
libgd / gd_graphics_library 2.0.34-rc2 2.0.34-rc2.x
libgd / gd_graphics_library 2.0.33 2.0.33.x
libgd / gd_graphics_library 2.0.34-rc1 2.0.34-rc1.x
libgd / gd_graphics_library 2.0.35-rc3 2.0.35-rc3.x
libgd / gd_graphics_library 2.0.35-rc2 2.0.35-rc2.x
libgd / gd_graphics_library 2.0.35-rc1 2.0.35-rc1.x
libgd / gd_graphics_library 2.0.35 2.0.35.x
libgd / gd_graphics_library 2.0.36-rc1 2.0.36-rc1.x
libgd / gd_graphics_library 2.0.34 2.0.34.x
libgd / gd_graphics_library 2.0.35-rc5 2.0.35-rc5.x
libgd / gd_graphics_library 2.0.35-rc4 2.0.35-rc4.x
php / php 5.2.11 5.2.11.x
php / php 5.3.0 5.3.0.x