PT-2019-5039 · Php+4 · Php+4
Cmb
·
Publicado
2019-05-05
·
Atualizado
2024-06-15
·
CVE-2019-11038
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
GD Graphics Library versions 2.2.5
PHP versions 7.1.x through 7.1.29
PHP versions 7.2.x through 7.2.18
PHP versions 7.3.x through 7.3.5
Description
The issue is related to the
gdImageCreateFromXbm() function in the GD Graphics Library, which is used in the PHP GD extension. It is caused by a lack of input validation, allowing a remote attacker to supply data that may lead to the disclosure of contents of the stack left by previous code. This can potentially allow unauthorized access to information.Recommendations
For PHP versions 7.1.x through 7.1.29, update to version 7.1.30 or later.
For PHP versions 7.2.x through 7.2.18, update to version 7.2.19 or later.
For PHP versions 7.3.x through 7.3.5, update to version 7.3.6 or later.
As a temporary workaround, consider disabling the
gdImageCreateFromXbm() function until a patch is available.Exploit
Correção
RCE
Use of Uninitialized Resource
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Gd Graphics Library
Php
Suse
Ubuntu