CVE-2019-11038

When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been left there by previous code.
References
Link Resource
https://bugs.php.net/bug.php?id=77973 Vendor Advisory
https://lists.debian.org/debian-lts-announce/2019/06/msg00003.html Mailing List Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1724149 Exploit Issue Tracking Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1140120 Exploit Issue Tracking Third Party Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=929821 Mailing List Third Party Advisory
https://github.com/libgd/libgd/issues/501 Exploit Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1724432 Exploit Issue Tracking Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKSSWFR2WPMUOIB5EN5ZM252NNEPYUTG/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WAZBVK6XNYEIN7RDQXESSD63QHXPLKWL/ Mailing List Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1140118 Exploit Issue Tracking Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2519 Third Party Advisory
https://seclists.org/bugtraq/2019/Sep/38 Mailing List Third Party Advisory
https://www.debian.org/security/2019/dsa-4529 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3299 Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00020.html Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3CZ2QADQTKRHTGB2AHD7J4QQNDLBEMM6/ Mailing List Third Party Advisory
https://usn.ubuntu.com/4316-2/ Third Party Advisory
https://usn.ubuntu.com/4316-1/ Third Party Advisory
Advertisement

NeevaHost hosting service

Configurations

Configuration 1 (hide)

OR cpe:2.3:a:libgd:libgd:2.2.5:*:*:*:*:*:*:*
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*

Configuration 5 (hide)

OR cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp4:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_desktop:12:sp4:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:12:sp4:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:12:sp5:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:sp4:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:sp5:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:sp4:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:sp5:*:*:*:*:*:*

Configuration 6 (hide)

OR cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

Information

Published : 2019-06-18 17:15

Updated : 2020-10-16 05:58


NVD link : CVE-2019-11038

Mitre link : CVE-2019-11038


JSON object : View

CWE
CWE-908

Use of Uninitialized Resource

Advertisement

dedicated server usa

Products Affected

redhat

  • enterprise_linux
  • software_collections

suse

  • linux_enterprise_desktop
  • linux_enterprise_software_development_kit
  • linux_enterprise_workstation_extension
  • linux_enterprise_debuginfo
  • linux_enterprise_server

libgd

  • libgd

fedoraproject

  • fedora

canonical

  • ubuntu_linux

opensuse

  • leap

php

  • php

debian

  • debian_linux