Vulnerability CVE-2019-11038
Published: 2019-06-18   Modified: 2019-06-19

Description:
When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been left there by previous code.

Type:

CWE-20

 (Improper Input Validation)

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5/10
2.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None
Affected software
PHP -> PHP 

 References:
https://access.redhat.com/errata/RHSA-2019:2519
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=929821
https://bugs.php.net/bug.php?id=77973
https://bugzilla.redhat.com/show_bug.cgi?id=1724149
https://bugzilla.redhat.com/show_bug.cgi?id=1724432
https://bugzilla.suse.com/show_bug.cgi?id=1140118
https://bugzilla.suse.com/show_bug.cgi?id=1140120
https://github.com/libgd/libgd/issues/501
https://lists.debian.org/debian-lts-announce/2019/06/msg00003.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKSSWFR2WPMUOIB5EN5ZM252NNEPYUTG/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WAZBVK6XNYEIN7RDQXESSD63QHXPLKWL/
Copyright 2024, cxsecurity.com

 

Back to Top