VYPR
← All advisories
Unrated severityNVD Advisory· Published Feb 18, 2014· Updated Apr 29, 2026

CVE-2013-7327

CVE-2013-7327

Description

Missing return value check in gdImageCrop allows NULL pointer dereference, causing DoS or potential code execution in PHP 5.5.0-5.5.8.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Missing return value check in gdImageCrop allows NULL pointer dereference, causing DoS or potential code execution in PHP 5.5.0-5.5.8.

Vulnerability

In PHP versions 5.5.0 through 5.5.8, the gdImageCrop function in ext/gd/gd.c fails to validate return values from GD library calls. When invalid arguments are supplied to the imagecrop() function, a NULL pointer may be returned and subsequently dereferenced, leading to a crash. This issue is distinct from CVE-2013-7226, which involves an integer overflow in the same function [2].

Exploitation

An attacker who can control the arguments passed to imagecrop() (e.g., via a web application that processes user-supplied images) can trigger the NULL pointer dereference. No authentication is required if the function is exposed to unauthenticated users. The exploit involves supplying crafted x, y, width, or height parameters that cause the GD library to return a NULL resource [1].

Impact

The primary impact is denial of service (application crash). The Ubuntu security advisory notes that this vulnerability could also potentially lead to information disclosure or arbitrary code execution, though the null pointer dereference itself typically results in a crash [1].

Mitigation

The vulnerability is fixed in PHP 5.5.9, released on 6 February 2014 [2]. Users should upgrade to PHP 5.5.9 or later. Red Hat Enterprise Linux 5 and 6 are not affected because they do not include the vulnerable function (introduced in PHP 5.5.0) [2]. If upgrading is not possible, consider disabling the GD extension or restricting access to functions that invoke imagecrop().

References
  1. USN-2126-1: PHP vulnerabilities | Ubuntu security notices | Ubuntu
  2. 1065108 – (CVE-2013-7226, CVE-2013-7327, CVE-2013-7328, CVE-2014-2020) CVE-2013-7226 CVE-2013-7327 CVE-2013-7328 CVE-2014-2020 php: multiple vulnerabilities in gdImageCrop()

AI Insight generated on May 23, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

28
  • PHP/PHP21 versions
    cpe:2.3:a:php:php:*:*:*:*:*:*:*:*+ 20 more
    • cpe:2.3:a:php:php:*:*:*:*:*:*:*:*range: <=5.5.8
    • cpe:2.3:a:php:php:5.5.0:alpha1:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.5.0:alpha2:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.5.0:alpha3:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.5.0:alpha4:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.5.0:alpha5:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.5.0:alpha6:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.5.0:beta1:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.5.0:beta2:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.5.0:beta3:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.5.0:beta4:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.5.0:rc1:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.5.0:rc2:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.5.1:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.5.2:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.5.3:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.5.4:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.5.5:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.5.6:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.5.7:*:*:*:*:*:*:*
    • (no CPE)range: >=5.5.0, <5.5.9
  • Canonical/Ubuntu Linux4 versions
    cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:*+ 3 more
    • cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:*
    • cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
    • cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*
    • cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*
  • osv-coords3 versions
    pkg:rpm/opensuse/php5&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/php7&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/php8&distro=openSUSE%20Tumbleweed
    < 5.6.28-1.1+ 2 more
    • (no CPE)range: < 5.6.28-1.1
    • (no CPE)range: < 7.0.14-1.4
    • (no CPE)range: < 8.0.11-1.1

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

4

News mentions

0

No linked articles in our index yet.