CVE-2017-7890

What it actually does

The GIF decoding function fails to initialize colorMap arrays, allowing a crafted GIF to read approximately 700 bytes of uninitialized stack memory and disclose sensitive process data over the network.

Why it matters to the business

Attackers may obtain credentials, session tokens, or internal configuration details from PHP-based applications that accept or process user-supplied GIF images, increasing the risk of follow-on compromise.

How an attack unfolds

An attacker supplies a malicious GIF image that triggers gdImageCreateFromGifCtx in libgd; because the color tables are not zeroed, stack contents are copied into the decoded image structure and returned to the caller, exposing sensitive memory.

How to fix it

Upgrade PHP to 5.6.31 or newer and 7.1.7 or newer; rebuild against a patched libgd if custom builds are used; consider disabling GIF support where image formats can be restricted.

How to confirm the fix worked

Confirm PHP version is at or above the fixed releases; attempt to process a test GIF crafted to exercise the colorMap path and verify no stack data appears in output or logs.

Typical attack path

1. Identify a PHP application endpoint that accepts or renders GIF images
2. Craft a GIF that leaves colorMap uninitialized
3. Deliver the image via upload, URL parameter, or embedded resource
4. Observe the response or error output for leaked stack bytes

How to detect it

Search web-server and application logs for GIF processing requests that coincide with unusually large or malformed image responses; inspect error logs or debug output for unexpected binary data fragments.

What your security team should do

• Apply the PHP upgrades as the highest-priority action
• Audit all code paths that invoke imagecreatefromgif or equivalent GD functions
• Implement input sanitization or format whitelisting for image uploads
• Review historical access logs for GIF processing endpoints