Skip to content
CVE PROGRAM SOURCE RECORD3.1 Low

CVE-2019-11038

Uninitialized read in gdImageCreateFromXbm

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
php

Description

When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been left there by previous code.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

PHP Group PHP

  • 7.1.x < 7.1.30affected
  • 7.2.x < 7.2.19affected
  • 7.3.x < 7.3.6affected

References