CVE-2019-11038
Uninitialized read in gdImageCreateFromXbm
En bref Sévérité LOW 3.1 EPSS EPSS 4.33 % · centile 91 (2026-10-27) État PUBLISHED Publiée 2019-06-18 Mise à jour 2024-09-16 Attribuée par php Statut NVD Modified Description When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been left there by previous code.
Scores Version Score Vecteur Évalué par CVSS 3.0 LOW 3.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N php CVSS 3.1 MEDIUM 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N NVD · nvd@nist.gov (Primary) CVSS 3.0 LOW 3.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N NVD · security@php.net (Secondary) CVSS 2.0 MEDIUM 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N NVD · nvd@nist.gov (Primary)
Faiblesses (CWE)
Références européennes
Avis du CERT-FR
Configurations affectées (CPE NVD) cpe:2.3:a:libgd:libgd:2.2.5:*:*:*:*:*:*:*cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 7.1.0 < 7.1.30cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 7.2.0 < 7.2.19cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 7.3.0 < 7.3.6cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp4:*:*:*:*:*:*cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*cpe:2.3:o:suse:linux_enterprise_desktop:12:sp4:*:*:*:*:*:*cpe:2.3:o:suse:linux_enterprise_server:12:sp4:*:*:*:*:*:*cpe:2.3:o:suse:linux_enterprise_server:12:sp5:*:*:*:*:*:*cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:sp4:*:*:*:*:*:*cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:sp5:*:*:*:*:*:*cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:sp4:*:*:*:*:*:*cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:sp5:*:*:*:*:*:*cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*Produits affectés Produit Versions PHP Group · PHP affected 7.1.x < 7.1.30 ; affected 7.2.x < 7.2.19 ; affected 7.3.x < 7.3.6
Références
Sources
