Medium
Security advisory
When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been left there by previous code.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-11038
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 08:34 UTC · Revision 1
Source evidence
When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been left there by previous code.
osv:CVE-2019-11038
Complete source record
{
"id": "2db60d8f4719aa723cd8d6f1c6568c393729c9e7dfb24a24ecbc2099bddb8e36",
"url": "https://osv.dev/vulnerability/CVE-2019-11038",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-11038",
"summary": "When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been left there by previous code.",
"evidence": "osv:CVE-2019-11038",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2019-11038",
"aliases": [
"CVE-2019-11038"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/libgd/libgd",
"type": "GIT",
"events": [
{
"introduced": "8255231b68889597d04d451a72438ab92a405aba"
},
{
"last_affected": "8255231b68889597d04d451a72438ab92a405aba"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:libgd:libgd:2.2.5:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.2.5"
},
{
"last_affected": "2.2.5"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"2.2.5",
"gd-2.2.5"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-11038.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/php/php-src",
"type": "GIT",
"events": [
{
"introduced": "0221e9f827632942225586687a33cfd554860d5e"
},
{
"fixed": "835993236936bb4791ba0a705382072e65e1219a"
},
{
"introduced": "8148cbb78841c8ec0759c0836e7f35dec799d300"
},
{
"fixed": "e845291527f934db9fa4b001ad63651bd5bfb745"
},
{
"introduced": "52ace952a1b65ca80fc2617f11c2fa6dd03f51bd"
},
{
"fixed": "bd3656d9fde3bc2271fe6a27fca8df80b75d2202"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.1.0"
},
{
"fixed": "7.1.30"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.2.0"
},
{
"fixed": "7.2.19"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.3.0"
},
{
"fixed": "7.3.6"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-11038.json"
}
}
],
"modified": "2026-10-24T10:47:38.108923641Z",
"provider": "osv",
"references": [
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3CZ2QADQTKRHTGB2AHD7J4QQNDLBEMM6/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PKSSWFR2WPMUOIB5EN5ZM252NNEPYUTG/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WAZBVK6XNYEIN7RDQXESSD63QHXPLKWL/",
"https://access.redhat.com/errata/RHSA-2019:2519",
"https://access.redhat.com/errata/RHSA-2019:3299",
"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=929821",
"https://bugs.php.net/bug.php?id=77973",
"https://lists.debian.org/debian-lts-announce/2019/06/msg00003.html",
"https://seclists.org/bugtraq/2019/Sep/38",
"https://usn.ubuntu.com/4316-1/",
"https://usn.ubuntu.com/4316-2/",
"https://www.debian.org/security/2019/dsa-4529",
"https://bugzilla.redhat.com/show_bug.cgi?id=1724149",
"https://bugzilla.redhat.com/show_bug.cgi?id=1724432",
"https://bugzilla.suse.com/show_bug.cgi?id=1140118",
"https://bugzilla.suse.com/show_bug.cgi?id=1140120",
"https://github.com/libgd/libgd/issues/501"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*"
],
"vendor_product": "canonical:ubuntu_linux",
"extracted_events": [
{
"range": [
{
"introduced": "14.04"
},
{
"last_affected": "14.04"
},
{
"introduced": "16.04"
},
{
"last_affected": "16.04"
},
{
"introduced": "18.04"
},
{
"last_affected": "18.04"
},
{
"introduced": "19.10"
},
{
"last_affected": "19.10"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "8.0"
},
{
"last_affected": "8.0"
},
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*",
"cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*",
"cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*"
],
"vendor_product": "fedoraproject:fedora",
"extracted_events": [
{
"range": [
{
"introduced": "29"
},
{
"last_affected": "29"
},
{
"introduced": "30"
},
{
"last_affected": "30"
},
{
"introduced": "32"
},
{
"last_affected": "32"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*"
],
"vendor_product": "opensuse:leap",
"extracted_events": [
{
"range": [
{
"introduced": "15.1"
},
{
"last_affected": "15.1"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*",
"cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:enterprise_linux",
"extracted_events": [
{
"range": [
{
"introduced": "7.0"
},
{
"last_affected": "7.0"
},
{
"introduced": "8.0"
},
{
"last_affected": "8.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:software_collections",
"extracted_events": [
{
"range": [
{
"introduced": "1.0"
},
{
"last_affected": "1.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp4:*:*:*:*:*:*"
],
"vendor_product": "suse:linux_enterprise_debuginfo",
"extracted_events": [
{
"range": [
{
"introduced": "11-sp4"
},
{
"last_affected": "11-sp4"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:suse:linux_enterprise_desktop:12:sp4:*:*:*:*:*:*"
],
"vendor_product": "suse:linux_enterprise_desktop",
"extracted_events": [
{
"range": [
{
"introduced": "12-sp4"
},
{
"last_affected": "12-sp4"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:suse:linux_enterprise_server:12:sp4:*:*:*:*:*:*",
"cpe:2.3:o:suse:linux_enterprise_server:12:sp5:*:*:*:*:*:*"
],
"vendor_product": "suse:linux_enterprise_server",
"extracted_events": [
{
"range": [
{
"introduced": "12-sp4"
},
{
"last_affected": "12-sp4"
},
{
"introduced": "12-sp5"
},
{
"last_affected": "12-sp5"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:sp4:*:*:*:*:*:*",
"cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:sp5:*:*:*:*:*:*"
],
"vendor_product": "suse:linux_enterprise_software_development_kit",
"extracted_events": [
{
"range": [
{
"introduced": "12-sp4"
},
{
"last_affected": "12-sp4"
},
{
"introduced": "12-sp5"
},
{
"last_affected": "12-sp5"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:sp4:*:*:*:*:*:*",
"cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:sp5:*:*:*:*:*:*"
],
"vendor_product": "suse:linux_enterprise_workstation_extension",
"extracted_events": [
{
"range": [
{
"introduced": "12-sp4"
},
{
"last_affected": "12-sp4"
},
{
"introduced": "12-sp5"
},
{
"last_affected": "12-sp5"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2019-11038",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 441422,
"published_at": "2019-06-19T00:15:12.36+00:00"
}