CVE-2019-11038

MEDIUM

libgd - Information Disclosure via Uninitialized Variable in gdImageCreateFromXbm

Title source: llm
STIX 2.1

Description

When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been left there by previous code.

References (18)

Core 18
Core References
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2019/06/msg00003.html
Vendor Advisory x_refsource_confirm
https://bugs.php.net/bug.php?id=77973
Exploit, Third Party Advisory x_refsource_confirm
https://github.com/libgd/libgd/issues/501
Mailing List, Third Party Advisory x_refsource_confirm
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=929821
Exploit, Issue Tracking, Third Party Advisory x_refsource_confirm
https://bugzilla.suse.com/show_bug.cgi?id=1140118
Exploit, Issue Tracking, Third Party Advisory x_refsource_confirm
https://bugzilla.suse.com/show_bug.cgi?id=1140120
Exploit, Issue Tracking, Third Party Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1724149
Exploit, Issue Tracking, Third Party Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=1724432
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:2519
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2019/dsa-4529
Mailing List, Third Party Advisory mailing-list x_refsource_bugtraq
https://seclists.org/bugtraq/2019/Sep/38
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:3299
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00020.html
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/4316-2/
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/4316-1/

Scores

CVSS v3 5.3
EPSS 0.0433
EPSS Percentile 89.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-457 CWE-908
Status published
Products (20)
canonical/ubuntu_linux 14.04
canonical/ubuntu_linux 16.04
canonical/ubuntu_linux 18.04
canonical/ubuntu_linux 19.10
debian/debian_linux 8.0
debian/debian_linux 9.0
fedoraproject/fedora 29
fedoraproject/fedora 30
fedoraproject/fedora 32
libgd/libgd 2.2.5
... and 10 more
Published Jun 19, 2019
Tracked Since Feb 18, 2026