CVE-2019-11038

Name of the Vulnerable Software and Affected Versions GD Graphics Library versions 2.2.5 PHP versions 7.1.x through 7.1.29 PHP versions 7.2.x through 7.2.18 PHP versions 7.3.x through 7.3.5

Description The issue is related to the gdImageCreateFromXbm() function in the GD Graphics Library, which is used in the PHP GD extension. It is caused by a lack of input validation, allowing a remote attacker to supply data that may lead to the disclosure of contents of the stack left by previous code. This can potentially allow unauthorized access to information.

Recommendations For PHP versions 7.1.x through 7.1.29, update to version 7.1.30 or later. For PHP versions 7.2.x through 7.2.18, update to version 7.2.19 or later. For PHP versions 7.3.x through 7.3.5, update to version 7.3.6 or later. As a temporary workaround, consider disabling the gdImageCreateFromXbm() function until a patch is available.