CVE-2019-11038
PoC ×5—CVSS 3.1
5.3 medium
EPSS
4%p91
Published
()
Modified
Description
When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been left there by previous code.
- Vendors
- libgdphpcanonicaldebianfedoraprojectsuseopensuseredhat
- Products
- libgd, php, ubuntu linux, debian linux, fedora, linux enterprise debuginfo, leap, linux enterprise desktop, linux enterprise server, linux enterprise software development kit, linux enterprise workstation extension, software collections
- Weakness
- CWE-457, CWE-908
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
In the news0 stories
No ingested article mentions this CVE yet.