CVE-2019-11038
Uninitialized read in gdImageCreateFromXbm
- State
- Published
- Severity
- 3.1 Low
- Published
- Jun 18, 2019
- Updated
- Sep 16, 2024
- Reserved
- Apr 9, 2019
Description
When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been left there by previous code.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 3.1 Low | CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N | php |
Weaknesses
- CWE-457 Use of Uninitialized Variable
Affected Products
| Product | Versions |
|---|---|
PHPPHP Group |
|
References
- FEDORA-2019-be4f895015vendor-advisory
- FEDORA-2019-8c4b25b5ecvendor-advisory
- [debian-lts-announce] 20190611 [SECURITY] [DLA 1817-1] libgd2 security updatemailing-list
- https://bugs.php.net/bug.php?id=77973
- https://github.com/libgd/libgd/issues/501
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=929821
- https://bugzilla.suse.com/show_bug.cgi?id=1140118
- https://bugzilla.suse.com/show_bug.cgi?id=1140120
- https://bugzilla.redhat.com/show_bug.cgi?id=1724149
- https://bugzilla.redhat.com/show_bug.cgi?id=1724432
- RHSA-2019:2519vendor-advisory
- DSA-4529vendor-advisory
- 20190923 [SECURITY] [DSA 4529-1] php7.0 security updatemailing-list
- RHSA-2019:3299vendor-advisory
- openSUSE-SU-2020:0332vendor-advisory
- FEDORA-2020-e795f92d79vendor-advisory
- USN-4316-2vendor-advisory
- USN-4316-1vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.