Doc #75788 [Csd]: [FG-VD-18-005] PHP GD Denial of Service Vulnerability Notification

Edit report at https://bugs.php.net/bug.php?id=75788&edit=1 ID: 75788 User updated by: zyyang at fortinet dot com Reported by: zyyang at fortinet dot com Summary: [FG-VD-18-005] PHP GD Denial of Service Vulnerability Notification Status: Closed Type: Documentation Problem Package: GD related Operating System: CentOS 6.8 x64 PHP Version: 5.6.33 Assigned To: cmb Block user comment: N Private report: N New Comment: Hi, I found a similar issue with this one. May help you reconsider it as a security issue, it happens on web servers and may let servers went down. https://bugs.php.net/bug.php?id=66387 https://github.com/libgd/libgd/issues/213 Previous Comments: ------------------------------------------------------------------------ [2018-01-17 12:24:49] cmb@php.net > In change log, can you add a short note like thanks for Zhouyuan > Yang of Fortinet's FortiGuard Labs? Unfortunately, the SVN server is not configured to allow for prop changes. ------------------------------------------------------------------------ [2018-01-16 17:44:37] zyyang at fortinet dot com Hi, In change log, can you add a short note like thanks for Zhouyuan Yang of Fortinet's FortiGuard Labs? ------------------------------------------------------------------------ [2018-01-15 14:02:21] cmb@php.net The documentation regarding this issue has been improved: <http://svn.php.net/viewvc?view=revision&revision=343841>. @zyyang Is that sufficient? ------------------------------------------------------------------------ [2018-01-11 23:44:13] zyyang at fortinet dot com Great! Thanks for your time! If there will be a note in the document, please let me know. ------------------------------------------------------------------------ [2018-01-11 23:40:05] stas@php.net The software that uses only file size and the software that checks different values than it sends to imagecopyresampled() should of course be fixed. But I am afraid we can't do much here to fix it, that should be done by the developers of that software. Since GIF can be not a single image but collection of images (e.g. animated GIFs), it is indeed a good idea to document which of the sizes each function returns. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=75788 -- Edit this bug report at https://bugs.php.net/bug.php?id=75788&edit=1