Strix
26.1K

CVE-2019-6977

UnknownEPSS 65.12%

Last modified

CVE-2019-6977 is a vulnerability of currently unknown severity. gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch function in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1, has a heap-based buffer overflow. This can be exploited by an attacker who is able to trigger imagecolormatch calls with crafted image data.. EPSS estimates a 65.12% chance of exploitation in the next 30 days.

Description

gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch function in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1, has a heap-based buffer overflow. This can be exploited by an attacker who is able to trigger imagecolormatch calls with crafted image data.

Metrics

EPSS Probability
65.12%

99.2th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
LibgdLibgd2.2.5
PhpPhp< 5.6.40
PhpPhp>= 7.0.0, < 7.1.26
PhpPhp>= 7.2.0, < 7.2.14
PhpPhp7.3.0
DebianDebian Linux8.0
DebianDebian Linux9.0
CanonicalUbuntu Linux14.04
CanonicalUbuntu Linux16.04
CanonicalUbuntu Linux18.04
CanonicalUbuntu Linux18.10
NetappStorage Automation StoreAll versions

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2019-6977?
gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch function in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1, has a heap-based buffer overflow. This can be exploited by an attacker who is able to trigger imagecolormatch calls with crafted image data.
How severe is CVE-2019-6977?
Severity scoring for CVE-2019-6977 is pending analysis. The EPSS model estimates a 65.12% probability of exploitation in the next 30 days.
How do I fix CVE-2019-6977?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2019-6977?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST