CVE-2019-11038

When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been left there by previous code.

Score
CVSS 3.1 5.3 Medium
Status
Modified - security@php.net
Published
2019-06-19
Last modified
2024-09-16
Weaknesses
CWE-457, CWE-908

Affected products

References

 
 
© AVABIS GmbH privacypolicy about