Description

When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been left there by previous code.

Remediation

References

CVE-2019-11038

Related Vulnerabilities

JBoss Application Server Directory Traversal Vulnerability (CVE-2006-5750)

WordPress Plugin Qyrr-simply and modern QR-Code creation Cross-Site Scripting (0.6)

Moodle Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2006-4785)

WordPress Plugin Tags Cloud Manager Cross-Site Scripting (1.0.0)

WordPress Plugin Prevent files/folders access Cross-Site Request Forgery (1.1.1)

Severity

Medium

Classification

CVE-2019-11038 CWE-908 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities