blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2019-11038

MEDIUM 5.3 CVSS 3.1
Published
June 19, 2019
Last modified
June 17, 2026
NVD status
Modified
Reported by
security@php.net
Weakness
CWE-457, CWE-908
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Description

When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been left there by previous code.

Affected products and versions

  • PHP — From 7.1.0 (including) to 7.1.30 (excluding)
  • PHP — From 7.2.0 (including) to 7.2.19 (excluding)
  • PHP — From 7.3.0 (including) to 7.3.6 (excluding)

References

  • lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00020.html Mailing List, Third Party Advisory
  • access.redhat.com https://access.redhat.com/errata/RHSA-2019:2519 Third Party Advisory
  • access.redhat.com https://access.redhat.com/errata/RHSA-2019:3299 Third Party Advisory
  • bugs.debian.org https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=929821 Mailing List, Third Party Advisory
  • bugs.php.net https://bugs.php.net/bug.php?id=77973 Vendor Advisory
  • bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=1724149 Exploit, Issue Tracking, Third Party Advisory
  • bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=1724432 Exploit, Issue Tracking, Third Party Advisory
  • bugzilla.suse.com https://bugzilla.suse.com/show_bug.cgi?id=1140118 Exploit, Issue Tracking, Third Party Advisory
  • bugzilla.suse.com https://bugzilla.suse.com/show_bug.cgi?id=1140120 Exploit, Issue Tracking, Third Party Advisory
  • github.com https://github.com/libgd/libgd/issues/501 Exploit, Third Party Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2019/06/msg00003.html Mailing List, Third Party Advisory
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3CZ2QADQTKRHTGB2AHD7J4QQNDLBEMM6/
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PKSSWFR2WPMUOIB5EN5ZM252NNEPYUTG/
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WAZBVK6XNYEIN7RDQXESSD63QHXPLKWL/
  • seclists.org https://seclists.org/bugtraq/2019/Sep/38 Mailing List, Third Party Advisory
  • usn.ubuntu.com https://usn.ubuntu.com/4316-1/ Third Party Advisory
  • usn.ubuntu.com https://usn.ubuntu.com/4316-2/ Third Party Advisory
  • www.debian.org https://www.debian.org/security/2019/dsa-4529 Third Party Advisory
  • nvd.nist.gov Official NVD record