When using gdImageCreateFromXbm() function of PHP gd extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been left there by previous code. Reference: https://github.com/libgd/libgd/issues/501 https://bugs.php.net/bug.php?id=77973
Created php tracking bugs for this issue: Affects: fedora-all [bug 1724156]
Created gd tracking bugs for this issue: Affects: fedora-all [bug 1724432]
Upstream commit for this issue: https://github.com/mejo-/libgd/commit/c76ed17aee1f88e1bf9b9fc2c9b29a9a462aa347
PHP upstream commit: http://git.php.net/?p=php-src.git;a=commitdiff;h=ed6dee9a198c904ad5e03113e58a2d2c200f5184 libgd upstream merge request is still open: https://github.com/libgd/libgd/pull/503
libgd is a library which create images based in several input formats, include the XBM format. When creating a output image based on a XBM file, under some situations the function gdImageCreateFromXbm() end up using a uninitialized variable value. As the values resides on process stack and attack may leverage this issue by crafting a XBM input file leading to stack information disclosure. As the information is not directly exposed the security impact for this issue is considered Low. The PHP is also affected through php-gd extension package, as it ships its own bundled gd library.
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Via RHSA-2019:2519 https://access.redhat.com/errata/RHSA-2019:2519
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-11038
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS Via RHSA-2019:3299 https://access.redhat.com/errata/RHSA-2019:3299