NetSight
IP …
medium5.3

CVE-2019-11038

When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30…

Impact

When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been left there by previous code.

Affected products

VendorProductAffected versions
LibgdLibgd
Version 2.2.5
PhpPhp
from 7.1.0 before 7.1.30
from 7.2.0 before 7.2.19
from 7.3.0 before 7.3.6
CanonicalUbuntu Linux
Versions 14.04, 16.04, 18.04, 19.10
DebianDebian Linux
Versions 8.0, 9.0
FedoraprojectFedora
Versions 29, 30, 32
SuseLinux Enterprise Debuginfo
Version 11
OpensuseLeap
Version 15.1
SuseLinux Enterprise Desktop
Version 12
SuseLinux Enterprise Server
Version 12
SuseLinux Enterprise Software Development Kit
Version 12
SuseLinux Enterprise Workstation Extension
Version 12
RedhatSoftware Collections
Version 1.0

Weakness classification

CWE-457CWE-908

References