p PatchFirst

CVE-2019-11038

CVE-2019-11038 · Uninitialized read in gdImageCreateFromXbm

This page contains facts from public vulnerability sources. Check the original advisory before updating.

When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been left there by previous code.

CVSS 3.1 · Low · EPSS 4.3% · Fix available

Published
Updated

Stack: system · php

Affected products and versions

  • php

    Versions
    • 7.1.x < 7.1.30: Affected
    • 7.2.x < 7.2.19: Affected
    • 7.3.x < 7.3.6: Affected

    No fix published

  • libgd2 Debian:12

    Affected ranges
    • ECOSYSTEM: < 2.2.5-5.2

    Update to 2.2.5-5.2

  • libgd2 Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.2.5-5.2

    Update to 2.2.5-5.2

  • libgd2 Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.2.5-5.2

    Update to 2.2.5-5.2

  • libgd2 Ubuntu:Pro:14.04:LTS

    Versions
    • 2.1.0-2
    • 2.1.0-3
    • 2.1.0-3ubuntu0.1
    • 2.1.0-3ubuntu0.2
    • 2.1.0-3ubuntu0.3
    • 2.1.0-3ubuntu0.5
    • 2.1.0-3ubuntu0.6
    • 2.1.0-3ubuntu0.7
    • 2.1.0-3ubuntu0.8
    • 2.1.0-3ubuntu0.10
    • 2.1.0-3ubuntu0.11
    Affected ranges
    • ECOSYSTEM: < 2.1.0-3ubuntu0.11+esm1

    Update to 2.1.0-3ubuntu0.11+esm1

  • libgd2 Ubuntu:16.04:LTS

    Versions
    • 2.1.1-4build1
    • 2.1.1-4build2
    • 2.1.1-4ubuntu0.16.04.1
    • 2.1.1-4ubuntu0.16.04.2
    • 2.1.1-4ubuntu0.16.04.3
    • 2.1.1-4ubuntu0.16.04.5
    • 2.1.1-4ubuntu0.16.04.6
    • 2.1.1-4ubuntu0.16.04.7
    • 2.1.1-4ubuntu0.16.04.8
    • 2.1.1-4ubuntu0.16.04.10
    • 2.1.1-4ubuntu0.16.04.11
    Affected ranges
    • ECOSYSTEM: < 2.1.1-4ubuntu0.16.04.12

    Update to 2.1.1-4ubuntu0.16.04.12

  • libgd2 Ubuntu:18.04:LTS

    Versions
    • 2.2.5-3
    • 2.2.5-4
    • 2.2.5-4ubuntu0.2
    • 2.2.5-4ubuntu0.3
    Affected ranges
    • ECOSYSTEM: < 2.2.5-4ubuntu0.4

    Update to 2.2.5-4ubuntu0.4

Original sources

Check your server →