PT-2019-5039 · Php+4 · Php+4
Cmb
·
Published
2019-05-05
·
Updated
2024-06-15
·
CVE-2019-11038
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
GD Graphics Library versions 2.2.5
PHP versions 7.1.x through 7.1.29
PHP versions 7.2.x through 7.2.18
PHP versions 7.3.x through 7.3.5
Description
The issue is related to the
gdImageCreateFromXbm() function in the GD Graphics Library, which is used in the PHP GD extension. It is caused by a lack of input validation, allowing a remote attacker to supply data that may lead to the disclosure of contents of the stack left by previous code. This can potentially allow unauthorized access to information.Recommendations
For PHP versions 7.1.x through 7.1.29, update to version 7.1.30 or later.
For PHP versions 7.2.x through 7.2.18, update to version 7.2.19 or later.
For PHP versions 7.3.x through 7.3.5, update to version 7.3.6 or later.
As a temporary workaround, consider disabling the
gdImageCreateFromXbm() function until a patch is available.Exploit
Fix
RCE
Use of Uninitialized Resource
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Gd Graphics Library
Php
Suse
Ubuntu