blah not our problem"
im not sure if theres a patch for the imagegif() as
i havent seen that one before.
- Original Message -
From:
peter MC
tachatte
To: full-disclosure@lists.grok.org.uk
Sent: Tuesday, October 18, 2005 9:55
AM
Subject: [Full-disclosure] P
Hello,
In reguads to the the curl, I have just checked all the php curl code
this was fixed in 4.3.10 from what i can see, because i wrote a patch
to stop the openbase dir in curl until php fixed it, i submited it
along time ago but the php dev's were all blah blah blah 3rd party
software
There is a vulnerability (Safedir Restriction Bypass)identified within the GD extension affectingthe following functions:- imagegif()- imagepng()- imagejpeg()in /ext/gd/gd.c line 1647
Which is now fixed in the cvshttp://cvs.php.net/co.php/php-src/ext/gd/gd.c?r=1.312.2.1#1786
POC:
with an image
