Bug 1724149 (CVE-2019-11038)
| Summary: | CVE-2019-11038 gd: Information disclosure in gdImageCreateFromXbm() | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Dhananjay Arunesh <darunesh> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | databases-maint, fedora, hhorak, jmlich83, jmoskovc, jorton, mskalick, panovotn, rcollet, webstack-team, yozone |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | php 7.1.30, php 7.2.19, php 7.3.6 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-08-19 08:48:06 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1724156, 1724432, 1727332, 1727334, 1727335, 1727336, 1727337, 1727338, 1727340 | ||
| Bug Blocks: | 1724431 | ||
|
Description
Dhananjay Arunesh
2019-06-26 10:57:39 UTC
Created php tracking bugs for this issue: Affects: fedora-all [bug 1724156] Created gd tracking bugs for this issue: Affects: fedora-all [bug 1724432] Upstream commit for this issue: https://github.com/mejo-/libgd/commit/c76ed17aee1f88e1bf9b9fc2c9b29a9a462aa347 PHP upstream commit: http://git.php.net/?p=php-src.git;a=commitdiff;h=ed6dee9a198c904ad5e03113e58a2d2c200f5184 libgd upstream merge request is still open: https://github.com/libgd/libgd/pull/503 libgd is a library which create images based in several input formats, include the XBM format. When creating a output image based on a XBM file, under some situations the function gdImageCreateFromXbm() end up using a uninitialized variable value. As the values resides on process stack and attack may leverage this issue by crafting a XBM input file leading to stack information disclosure. As the information is not directly exposed the security impact for this issue is considered Low. The PHP is also affected through php-gd extension package, as it ships its own bundled gd library. This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Via RHSA-2019:2519 https://access.redhat.com/errata/RHSA-2019:2519 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-11038 This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS Via RHSA-2019:3299 https://access.redhat.com/errata/RHSA-2019:3299 |