HOMEVULNERABILITIESCVE-2019-11038
MEDIUM

CVE-2019-11038

CWE-457Published: June 19, 2019· Updated: Jun 17, 2026

5.3
CVSS v3.1

Official Description

When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been left there by previous code.

NVD Source

Technical Analysis

CVE-2019-11038 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

CVSS v3.1 Vector Breakdown

Exploitability
Attack VectorNetwork
Attack ComplexityLow
Privileges Req.None
User InteractionNone
ScopeUnchanged
Impact
ConfidentialityLow
IntegrityNone
AvailabilityNone
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected Vendors & Products

Canonical1 product(s)
ubuntu linux
Debian1 product(s)
debian linux
Fedora1 product(s)
fedora
libgd1 product(s)
libgd
openSUSE1 product(s)
leap
PHP1 product(s)
php
Red Hat2 product(s)
software collectionsenterprise linux
SUSE5 product(s)
linux enterprise debuginfolinux enterprise desktoplinux enterprise serverlinux enterprise software development kitlinux enterprise workstation extension
Source: NVD CPE · 20 total CPE entries

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time
Exploit-DB
Offensive Security exploit database
GitHub PoC Search
Community PoC repositories
Rapid7 / Metasploit
Metasploit module search
PacketStorm
Security advisories & exploits
NVD Detail
Official NIST entry
MITRE CVE
CVE Program entry
External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2020-03/msg00020.html
ADVISORYhttps://access.redhat.com/errata/RHSA-2019:2519
ADVISORYhttps://access.redhat.com/errata/RHSA-2019:3299
ADVISORYhttps://bugs.debian.org/cgi-bin/bugreport.cgi?bug=929821
ADVISORYhttps://bugs.php.net/bug.php?id=77973
ADVISORYhttps://bugzilla.redhat.com/show_bug.cgi?id=1724149
ADVISORYhttps://bugzilla.redhat.com/show_bug.cgi?id=1724432
ADVISORYhttps://bugzilla.suse.com/show_bug.cgi?id=1140118
ADVISORYhttps://bugzilla.suse.com/show_bug.cgi?id=1140120
ADVISORYhttps://github.com/libgd/libgd/issues/501
ADVISORYhttps://lists.debian.org/debian-lts-announce/2019/06/msg00003.html
ADVISORYhttps://seclists.org/bugtraq/2019/Sep/38
ADVISORYhttps://usn.ubuntu.com/4316-1/
ADVISORYhttps://usn.ubuntu.com/4316-2/
ADVISORYhttps://www.debian.org/security/2019/dsa-4529
ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2020-03/msg00020.html
ADVISORYhttps://access.redhat.com/errata/RHSA-2019:2519
ADVISORYhttps://access.redhat.com/errata/RHSA-2019:3299
ADVISORYhttps://bugs.debian.org/cgi-bin/bugreport.cgi?bug=929821
ADVISORYhttps://bugs.php.net/bug.php?id=77973
ADVISORYhttps://bugzilla.redhat.com/show_bug.cgi?id=1724149
ADVISORYhttps://bugzilla.redhat.com/show_bug.cgi?id=1724432
ADVISORYhttps://bugzilla.suse.com/show_bug.cgi?id=1140118
ADVISORYhttps://bugzilla.suse.com/show_bug.cgi?id=1140120
ADVISORYhttps://github.com/libgd/libgd/issues/501
ADVISORYhttps://lists.debian.org/debian-lts-announce/2019/06/msg00003.html
ADVISORYhttps://seclists.org/bugtraq/2019/Sep/38
ADVISORYhttps://usn.ubuntu.com/4316-1/
ADVISORYhttps://usn.ubuntu.com/4316-2/
ADVISORYhttps://www.debian.org/security/2019/dsa-4529

All References (36)

→
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00020.htmlMailing List · Third Party Advisory
→
https://access.redhat.com/errata/RHSA-2019:2519Third Party Advisory
→
https://access.redhat.com/errata/RHSA-2019:3299Third Party Advisory
→
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=929821Mailing List · Third Party Advisory
→
https://bugs.php.net/bug.php?id=77973Vendor Advisory
→
https://bugzilla.redhat.com/show_bug.cgi?id=1724149Exploit · Issue Tracking · Third Party Advisory
→
https://bugzilla.redhat.com/show_bug.cgi?id=1724432Exploit · Issue Tracking · Third Party Advisory
→
https://bugzilla.suse.com/show_bug.cgi?id=1140118Exploit · Issue Tracking · Third Party Advisory
→
https://bugzilla.suse.com/show_bug.cgi?id=1140120Exploit · Issue Tracking · Third Party Advisory
→
https://github.com/libgd/libgd/issues/501Exploit · Third Party Advisory
→
https://lists.debian.org/debian-lts-announce/2019/06/msg00003.htmlMailing List · Third Party Advisory
→
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3CZ2QADQTKRHTGB2AHD7J4QQNDLBEMM6/
→
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PKSSWFR2WPMUOIB5EN5ZM252NNEPYUTG/
→
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WAZBVK6XNYEIN7RDQXESSD63QHXPLKWL/
→
https://seclists.org/bugtraq/2019/Sep/38Mailing List · Third Party Advisory

Quick Facts

CVE IDCVE-2019-11038
CVSS Score5.3 / 10
SeverityMEDIUM
WeaknessCWE-457
CISA KEVNo
Affected8 vendor(s)
PublishedJun 19, 2019

Related CVEs (CWE-457)

CVE-2025-54874
9.8
CVE-2022-21217
9.8
CVE-2022-40510
9.8
CVE-2024-47540
9.8
CVE-2025-53644
9.8
CVE-2021-40418
9.8

Recommended Actions

  • →Apply vendor patches immediately
  • →Monitor CVE-2019-11038 in threat intel feeds
  • →Review IDS/IPS signatures for exploitation attempts
Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWATCH.COM. CVE data is provided under the NVD usage policy.
← All Vulnerabilities·Search for CVE-2019-11038·NVD