Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2022-31630
CVE-2022-31630:
PHP vulnerability analysis and mitigation
Overview
CVE-2022-31630 affects PHP versions prior to 7.4.33, 8.0.25, and 8.1.12. The vulnerability exists in the imageloadfont() function within the GD extension, where a specially crafted font file can trigger an out-of-bounds read vulnerability when used with the imagechar() function (CVE Mitre).
Technical details
The vulnerability was introduced by commit 88b603768f8e5074ad5cbdccc1e0779089fac9d0 in PHP 7.4.0-alpha2. The issue occurs due to insufficient input validation in the imageloadfont() function, which allows for a zero-byte memory allocation to gdFont.data. When this malformed font is subsequently used with imagechar(), it triggers an out-of-bounds read beyond the allocated buffer (PHP Bug).
Impact
The exploitation of this vulnerability can lead to crashes or disclosure of confidential information through out-of-bounds read operations. This is particularly concerning for applications that allow users to upload and process arbitrary font files (NVD).
Mitigation and workarounds
The vulnerability has been fixed in PHP versions 7.4.33, 8.0.25, and 8.1.12. Users should upgrade to these or later versions to mitigate the risk. The fix involves additional overflow checks to prevent the zero-byte memory allocation issue (PHP Bug).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management