Strix
26.1K

CVE-2019-11038

MEDIUMCVSS 5.3/10EPSS 4.33%

Last modified

CVE-2019-11038 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been left there by previous code.. EPSS estimates a 4.33% chance of exploitation in the next 30 days.

Description

When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been left there by previous code.

Metrics

CVSS 3.1
5.3/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS Probability
4.33%

89.9th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersionsUpdate
LibgdLibgd2.2.5—
PhpPhp>= 7.1.0, < 7.1.30—
PhpPhp>= 7.2.0, < 7.2.19—
PhpPhp>= 7.3.0, < 7.3.6—
CanonicalUbuntu Linux14.04—
CanonicalUbuntu Linux16.04—
CanonicalUbuntu Linux18.04—
CanonicalUbuntu Linux19.10—
DebianDebian Linux8.0—
DebianDebian Linux9.0—
FedoraprojectFedora29—
FedoraprojectFedora30—
FedoraprojectFedora32—
SuseLinux Enterprise Debuginfo11Sp4
OpensuseLeap15.1—
SuseLinux Enterprise Desktop12Sp4
SuseLinux Enterprise Server12Sp4
SuseLinux Enterprise Software Development Kit12Sp4
SuseLinux Enterprise Workstation Extension12Sp4
RedhatSoftware Collections1.0—
RedhatEnterprise Linux7.0—
RedhatEnterprise Linux8.0—

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2019-11038?
When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been left there by previous code.
How severe is CVE-2019-11038?
CVE-2019-11038 has a CVSS score of 5.3/10 (MEDIUM severity). The EPSS model estimates a 4.33% probability of exploitation in the next 30 days.
How do I fix CVE-2019-11038?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2019-11038?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST