CVE-2022-31630 MEDIUM

CVE-2022-31630: OOB read due to insufficient input validation in imageloadfont()

Vendor Php Group
Product PHP
Weakness CWE-131
Published November 14, 2022
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

What the vulnerability does

01Description

In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() function, the read outside allocated buffer will be used. This can lead to crashes or disclosure of confidential information. 

Key dates

02Disclosure timeline

November 14, 2022 CVE published
August 3, 2024 Record updated