CVE-2019-11037
Out of bounds memory write in PHP Imagick extension
- State
- Published
- Severity
- 4.9 Medium
- Published
- May 3, 2019
- Updated
- Sep 16, 2024
- Reserved
- Apr 9, 2019
Description
In PHP imagick extension in versions between 3.3.0 and 3.4.4, writing to an array of values in ImagickKernel::fromMatrix() function did not check that the address will be within the allocated array. This could lead to out of bounds write to memory if the function is called with the data controlled by untrusted party.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 4.9 Medium | CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L | php |
Weaknesses
- CWE-787 Out-of-bounds Write
Affected Products
| Product | Versions |
|---|---|
PHP Imagick extensionPHP Group |
|
References
- https://bugs.php.net/bug.php?id=77791
- 108292vdb-entry
- https://github.com/CVEProject/cvelist/pull/1964
- FEDORA-2019-488d0f9a4bvendor-advisory
- FEDORA-2019-9448fa46f3vendor-advisory
- FEDORA-2019-5dc1f4100evendor-advisory
- DSA-4576vendor-advisory
- 20191126 [SECURITY] [DSA 4576-1] php-imagick security updatemailing-list
- openSUSE-SU-2020:0014vendor-advisory
- GLSA-202003-38vendor-advisory
- USN-4586-1vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.