Read the docs
TI-2019-08254 Aliases CVE-2019-11038GHSA-8v67-h8jw-j3r2

Uninitialized read in gdImageCreateFromXbm

Priority LOW 31CWE-457Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 6 fixed, 5 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-457 and the CVSS impact.

Summary

When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been left there by previous code.

Why it matters now

EPSS 0.04332 91st percentileScored 2026-11-07
Public exploit Yes 5 exploit referencesTagged by NVD
Fix Partial Red Hat: 2 advisoriesRed Hat: 6 fixed, 5 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
PHP GroupPHP7.1.x < 7.1.30; 7.2.x < 7.2.19; 7.3.x < 7.3.6—No fix listedCNA
  • PHP VendorPHP Group Affected 7.1.x < 7.1.30; 7.2.x < 7.2.19; 7.3.x < 7.3.6 Fixed in — No fix listed CNA

CPE configurations NVD · 23

CPEVersionsRoleVendor
cpe:2.3:a:libgd:libgd:2.2.5:*:*:*:*:*:*:*2.2.5VulnerableLibgd
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*7.1.0 to before 7.1.30; 7.2.0 to before 7.2.19; 7.3.0 to before 7.3.6VulnerablePHP
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*14.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*16.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*18.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*19.10VulnerableCanonical
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*29VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*30VulnerableFedoraproject
  • cpe:2.3:a:libgd:libgd:2.2.5:*:*:*:*:*:*:* Versions 2.2.5 Vulnerable ·Libgd
  • cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Versions 7.1.0 to before 7.1.30; 7.2.0 to before 7.2.19; 7.3.0 to before 7.3.6 Vulnerable ·PHP
  • cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* Versions 14.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:* Versions 19.10 Vulnerable ·Canonical
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* Versions 29 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
Show 13 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*32VulnerableFedoraproject
cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp4:*:*:*:*:*:*11 sp4VulnerableSUSE
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
cpe:2.3:o:suse:linux_enterprise_desktop:12:sp4:*:*:*:*:*:*12 sp4VulnerableSUSE
cpe:2.3:o:suse:linux_enterprise_server:12:sp4:*:*:*:*:*:*12 sp4VulnerableSUSE
cpe:2.3:o:suse:linux_enterprise_server:12:sp5:*:*:*:*:*:*12 sp5VulnerableSUSE
cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:sp4:*:*:*:*:*:*12 sp4VulnerableSUSE
cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:sp5:*:*:*:*:*:*12 sp5VulnerableSUSE
cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:sp4:*:*:*:*:*:*12 sp4VulnerableSUSE
cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:sp5:*:*:*:*:*:*12 sp5VulnerableSUSE
cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*1.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
  • cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
  • cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp4:*:*:*:*:*:* Versions 11 sp4 Vulnerable ·SUSE
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
  • cpe:2.3:o:suse:linux_enterprise_desktop:12:sp4:*:*:*:*:*:* Versions 12 sp4 Vulnerable ·SUSE
  • cpe:2.3:o:suse:linux_enterprise_server:12:sp4:*:*:*:*:*:* Versions 12 sp4 Vulnerable ·SUSE
  • cpe:2.3:o:suse:linux_enterprise_server:12:sp5:*:*:*:*:*:* Versions 12 sp5 Vulnerable ·SUSE
  • cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:sp4:*:*:*:*:*:* Versions 12 sp4 Vulnerable ·SUSE
  • cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:sp5:*:*:*:*:*:* Versions 12 sp5 Vulnerable ·SUSE
  • cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:sp4:*:*:*:*:*:* Versions 12 sp4 Vulnerable ·SUSE
  • cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:sp5:*:*:*:*:*:* Versions 12 sp5 Vulnerable ·SUSE
  • cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat

Remediation

Red Hat 2 advisories

  • RHSA-2019:3299 Released 2019-11-01 · Red Hat rating Critical
    rh-php72-php security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-php72-php-7.2.24-1.el7, rh-php72-php-bcmath-7.2.24-1.el7, rh-php72-php-cli-7.2.24-1.el7 +26
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-php72-php-7.2.24-1.el7, rh-php72-php-bcmath-7.2.24-1.el7, rh-php72-php-cli-7.2.24-1.el7 +26
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-php72-php-7.2.24-1.el7, rh-php72-php-bcmath-7.2.24-1.el7, rh-php72-php-cli-7.2.24-1.el7 +26
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-php72-php-7.2.24-1.el7, rh-php72-php-bcmath-7.2.24-1.el7, rh-php72-php-cli-7.2.24-1.el7 +26
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-php72-php-7.2.24-1.el7, rh-php72-php-bcmath-7.2.24-1.el7, rh-php72-php-cli-7.2.24-1.el7 +26
  • RHSA-2019:2519 Released 2019-08-19 · Red Hat rating Moderate
    rh-php71-php security, bug fix, and enhancement update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-php71-php-7.1.30-1.el7, rh-php71-php-bcmath-7.1.30-1.el7, rh-php71-php-cli-7.1.30-1.el7 +26
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-php71-php-7.1.30-1.el7, rh-php71-php-bcmath-7.1.30-1.el7, rh-php71-php-cli-7.1.30-1.el7 +26
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-php71-php-7.1.30-1.el7, rh-php71-php-bcmath-7.1.30-1.el7, rh-php71-php-cli-7.1.30-1.el7 +26
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-php71-php-7.1.30-1.el7, rh-php71-php-bcmath-7.1.30-1.el7, rh-php71-php-cli-7.1.30-1.el7 +26
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-php71-php-7.1.30-1.el7, rh-php71-php-bcmath-7.1.30-1.el7, rh-php71-php-cli-7.1.30-1.el7 +26

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 5AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Software CollectionsAffectedNo fix yet: Fix deferred
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2019:2519, RHSA-2019:3299
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)Fixed RHSA-2019:2519
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)Fixed RHSA-2019:2519, RHSA-2019:3299
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)Fixed RHSA-2019:2519, RHSA-2019:3299
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)Fixed RHSA-2019:3299
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2019:2519, RHSA-2019:3299
Not affected: 1 product
  • Red Hat Enterprise Linux 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-11038
  2. 2026-10-03 Alias added: GHSA-8v67-h8jw-j3r2

References

Exploit 5

Advisory 13

  • TI-2024-04260 Argument Injection in PHP-CGI KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-78794 PHP remote code execution via stale global state KEVCVSS 4.0CRITICAL 9.2
  • TI-2026-78793 Out-of-memory handling flaw in PHP allows remote code execution KEVCVSS 4.0CRITICAL 9.2
  • TI-2024-01743 Command injection via array-ish $command parameter of proc_open() CVSS 3.1CRITICAL 9.4
  • TI-2022-13555 PDO::quote() may return unquoted string CVSS 3.1CRITICAL 9.1
  • TI-2024-10408 Reference counting in php_request_shutdown causes Use-After-Free CVSS 4.0CRITICAL 9.2
See all 107 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences