Exploitation Summary
EIP tracks 2 public exploits for CVE-2018-5711. PoCs published by huzhenghui.
AI-analyzed exploit summary This Dockerfile sets up a PHP 7.2.0 environment and downloads a pre-compiled exploit (poc.gif) for CVE-2018-5711, a use-after-free vulnerability in PHP's GD library. The exploit is fetched from a GitHub raw content URL and converted from hexdump format using xxd.
Description
gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1, has an integer signedness error that leads to an infinite loop via a crafted GIF file, as demonstrated by a call to the imagecreatefromgif or imagecreatefromstring PHP function. This is related to GetCode_ and gdImageCreateFromGifCtx.
Exploits (2)
This Dockerfile sets up a PHP 7.2.0 environment and downloads a pre-compiled exploit (poc.gif) for CVE-2018-5711, a use-after-free vulnerability in PHP's GD library. The exploit is fetched from a GitHub raw content URL and converted from hexdump format using xxd.
This Dockerfile sets up a PHP 7.2.1 environment and downloads a pre-built exploit (poc.gif) for CVE-2018-5711, a vulnerability in PHP's GD library. The exploit is likely a crafted image file that triggers a buffer overflow or memory corruption when processed.
References (11)
Scores
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H