CVE-2019-11038

Public on 2019-07-17
Modified on 2019-07-25
Description
When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been left there by previous code.
Severity
Low
CVSS v3 Base Score
3.3
See breakdown

Affected Packages

Platform Package Release Date Advisory
Amazon Linux 1 php73 2019-07-17 23:33 ALAS-2019-1240
Amazon Linux 1 php71 2019-07-17 23:33 ALAS-2019-1240
Amazon Linux 1 php72 2019-07-17 23:33 ALAS-2019-1240

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
NVD CVSSv2 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N
NVD CVSSv3 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N