CVE-2013-7328: Multiple integer signedness errors in the gdImageCrop function in ext/gd/gd.c in PHP 5.5.x before 5.5.9 all...

Security readout for executives and security teams

This flaw affects PHP 5.5.x before 5.5.9 when image cropping is performed through GD. A malformed crop request using negative x or y values can crash the application and may expose sensitive information. The main business risk is instability or data leakage in legacy PHP services that process user-supplied images. Exposure is most likely in legacy PHP 5.5.x applications using the GD extension and imagecrop on user-controlled image parameters. The bundle does not identify other PHP branches or downstream packages as affected beyond the cited advisories. Prioritize remediation for internet-facing or customer-upload image services still running PHP 5.5.x. This is not presented as actively exploited, but the possible outcomes include service crashes and sensitive information exposure in a legacy runtime. Mitigation focus: Upgrade PHP 5.5.x deployments to 5.5.9 or a vendor-fixed package.; Apply relevant distribution advisories, including Ubuntu USN-2126-1 where applicable.; Validate crop coordinates before calling imagecrop; reject negative x or y values..

Prepared

Jun 14, 2026, 14:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.