CVEvulnerability
CVE-2019-11038
5.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2019-06-19
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- CVSS 3.0 ([email protected])
- 3.1 LOW — CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-457, CWE-908
Description
When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been left there by previous code.
Affected configurations
• libgd libgd 2.2.5
• php php (>= 7.1.0 < 7.1.30)
• php php (>= 7.2.0 < 7.2.19)
• php php (>= 7.3.0 < 7.3.6)
• canonical ubuntu linux 14.04
• canonical ubuntu linux 16.04
• canonical ubuntu linux 18.04
• canonical ubuntu linux 19.10
• debian debian linux 8.0
• debian debian linux 9.0
• fedoraproject fedora 29
• fedoraproject fedora 30
• fedoraproject fedora 32
• suse linux enterprise debuginfo 11
• opensuse leap 15.1
• suse linux enterprise desktop 12
• suse linux enterprise server 12
• suse linux enterprise software development kit 12
• suse linux enterprise workstation extension 12
• redhat software collections 1.0
• redhat enterprise linux 7.0
• redhat enterprise linux 8.0
Related
References
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00020.html Mailing List, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2519 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3299 Third Party Advisory
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=929821 Mailing List, Third Party Advisory
- https://bugs.php.net/bug.php?id=77973 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1724149 Exploit, Issue Tracking, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1724432 Exploit, Issue Tracking, Third Party Advisory
- https://bugzilla.suse.com/show_bug.cgi?id=1140118 Exploit, Issue Tracking, Third Party Advisory
- https://bugzilla.suse.com/show_bug.cgi?id=1140120 Exploit, Issue Tracking, Third Party Advisory
- https://github.com/libgd/libgd/issues/501 Exploit, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/06/msg00003.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3CZ2QADQTKRHTGB2AHD7J4QQNDLBEMM6/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PKSSWFR2WPMUOIB5EN5ZM252NNEPYUTG/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WAZBVK6XNYEIN7RDQXESSD63QHXPLKWL/ lists.fedoraproject.org
- https://seclists.org/bugtraq/2019/Sep/38 Mailing List, Third Party Advisory
- https://usn.ubuntu.com/4316-1/ Third Party Advisory
- https://usn.ubuntu.com/4316-2/ Third Party Advisory
- https://www.debian.org/security/2019/dsa-4529 Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00020.html Mailing List, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2519 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3299 Third Party Advisory
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=929821 Mailing List, Third Party Advisory
- https://bugs.php.net/bug.php?id=77973 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1724149 Exploit, Issue Tracking, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1724432 Exploit, Issue Tracking, Third Party Advisory
- https://bugzilla.suse.com/show_bug.cgi?id=1140118 Exploit, Issue Tracking, Third Party Advisory
- https://bugzilla.suse.com/show_bug.cgi?id=1140120 Exploit, Issue Tracking, Third Party Advisory
- https://github.com/libgd/libgd/issues/501 Exploit, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/06/msg00003.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3CZ2QADQTKRHTGB2AHD7J4QQNDLBEMM6/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PKSSWFR2WPMUOIB5EN5ZM252NNEPYUTG/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WAZBVK6XNYEIN7RDQXESSD63QHXPLKWL/ lists.fedoraproject.org
- https://seclists.org/bugtraq/2019/Sep/38 Mailing List, Third Party Advisory
- https://usn.ubuntu.com/4316-1/ Third Party Advisory
- https://usn.ubuntu.com/4316-2/ Third Party Advisory
- https://www.debian.org/security/2019/dsa-4529 Third Party Advisory