Open on HackerOneSign in

Internet Bug Bounty · Report #146936

CVE-2015-8874 Stack overflow with imagefilltoborder

Validstatus

$500bounty

1upvotes

13 Oct 2019disclosed

How it was found

Reported in 2014 https://bugs.php.net/bug.php?id=66387

A variation was rediscovered this year and reported to PHP and LIBGD: https://bugs.php.net/bug.php?id=72350 https://github.com/libgd/libgd/issues/215

Patches for both issues: http://git.php.net/?p=php-src.git;a=commit;h=f96ebb098697908641c6d37e1149cde1f90417fd https://github.com/php/php-src/commit/6d3fa654b702c8762aa80ab795080f5c4464d677

Fixed in PHP 5.5.37 (security only mode) http://php.net/ChangeLog-5.php#5.5.37

Fixed in PHP 5.6.23 http://php.net/ChangeLog-5.php#5.6.23

Fixed in PHP 7.0.8 http://php.net/ChangeLog-7.php#7.0.8

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original