CVE-2022-31630 in SD-WAN Aware

Summary

In PHP versions prior to 7.4.33, 8.0.25 and 8.2.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() function, the read outside allocated buffer will be used. This can lead to crashes or disclosure of confidential information.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Responsible

PHP Group

Reservation

05/25/2022

Disclosure

11/14/2022

Status

Confirmed

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
226421	Oracle SD-WAN Aware Management out-of-bounds	125	Not defined	Official fix	CVE-2022-31630
226420	Oracle Communications Diameter Signaling Router Platform out-of-bounds	125	Not defined	Official fix	CVE-2022-31630
213561	PHP GD Extension imageloadfont buffer size	131	Not defined	Official fix	CVE-2022-31630

Sources

• MITRE
• NVD
• CVE Details