When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been left there by previous code.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4316-1 advisory.

  - gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a NULL pointer dereference allowing attackers to     crash an application via a specific function call sequence. Only affects PHP when linked with an external     libgd (not bundled). (CVE-2018-14553)

  - When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in     the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is     possible to supply data that will cause the function to use the value of uninitialized variable. This may     lead to disclosing contents of the stack that has been left there by previous code. (CVE-2019-11038)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - When using the gdImageCreateFromXbm() function in the     GD Graphics Library (aka LibGD) 2.2.5, as used in the     PHP GD extension in PHP versions 7.1.x below 7.1.30,     7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is     possible to supply data that will cause the function to     use the value of uninitialized variable. This may lead     to disclosing contents of the stack that has been left     there by previous code.(CVE-2019-11038)

  - In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14     and 8.0.0, when validating URL with functions like     filter_var($url, FILTER_VALIDATE_URL), PHP will accept     an URL with invalid password as valid URL. This may     lead to functions that rely on URL being valid to     mis-parse the URL and produce wrong data as components     of the URL.(CVE-2020-7071)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2019:14158-1 advisory.

  - When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in     the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is     possible to supply data that will cause the function to use the value of uninitialized variable. This may     lead to disclosing contents of the stack that has been left there by previous code. (CVE-2019-11038)

  - When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in     PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with     data what will cause it to read past the allocated buffer. This may lead to information disclosure or     crash. (CVE-2019-11041, CVE-2019-11042)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the libgd package has been released.

This update for gd fixes the following issues :

Security issue fixed :

CVE-2018-14553: Fixed a NULL pointer dereference in gdImageClone (bsc#1165471).

CVE-2019-11038: Fixed a information disclosure in gdImageCreateFromXbm() (bsc#1140120).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New gd packages are available for Slackware 14.2 and -current to fix security issues.

This update for gd fixes the following issues :

Security issue fixed :

  - CVE-2018-14553: Fixed a NULL pointer dereference in     gdImageClone (bsc#1165471).

  - CVE-2019-11038: Fixed a information disclosure in     gdImageCreateFromXbm() (bsc#1140120).

This update was imported from the SUSE:SLE-15:Update update project.

This update for gd fixes the following issues :

CVE-2017-7890: Fixed a buffer over-read into uninitialized memory (bsc#1050241).

CVE-2018-14553: Fixed a NULL pointer dereference in gdImageClone() (bsc#1165471).

CVE-2019-11038: Fixed a information disclosure in gdImageCreateFromXbm() (bsc#1140120).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the gd package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - When using the gdImageCreateFromXbm() function in the     GD Graphics Library (aka LibGD) 2.2.5, as used in the     PHP GD extension in PHP versions 7.1.x below 7.1.30,     7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is     possible to supply data that will cause the function to     use the value of uninitialized variable. This may lead     to disclosing contents of the stack that has been left     there by previous code.(CVE-2019-11038)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the gd package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - When using the gdImageCreateFromXbm() function in the     GD Graphics Library (aka LibGD) 2.2.5, as used in the     PHP GD extension in PHP versions 7.1.x below 7.1.30,     7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is     possible to supply data that will cause the function to     use the value of uninitialized variable. This may lead     to disclosing contents of the stack that has been left     there by previous code.(CVE-2019-11038)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple security issues were found in PHP, a widely-used open source general purpose scripting language: Missing sanitising in the EXIF extension and the iconv_mime_decode_headers() function could result in information disclosure or denial of service.

This update for php7 fixes the following issues :

Security issues fixed :

CVE-2019-11038: Fixed a information disclosure in gdImageCreateFromXbm() (bsc#1140118).

CVE-2019-11041: Fixed heap buffer over-read in exif_scan_thumbnail() (bsc#1146360).

CVE-2019-11042: Fixed heap buffer over-read in exif_process_user_comment() (bsc#1145095).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Function iconv_mime_decode_headers() in PHP may perform out-of-buffer read due to integer overflow when parsing MIME headers. This may lead to information disclosure or crash.(CVE-2019-11039)

When using gdImageCreateFromXbm() function of PHP gd extension, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been left there by previous code. (CVE-2019-11038)

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash. (CVE-2019-11040)

According to its banner, the version of PHP running on the remote web server is 7.1.x prior to 7.1.30, 7.2.x prior to 7.2.19 or 7.3.x prior to 7.3.6. It is, therefore, affected by the following vulnerabilities:

 - An uninitialized read vulnerability exists in gdImageCreateFromXbm due to sscanf method not being able to read a hex value. An attacker may be able exploit this issue, to cause the disclose of sensitive information. (CVE-2019-11038)

 - An out of bounds read vulnerability exists in iconv.c:_php_iconv_mime_decode() due to integer overflow. An attacker may be able exploit this issue, to cause the disclose of sensitive information. (CVE-2019-11039)

 - A heap-based buffer overflow condition exists on php_jpg_get16. An attacker can exploit this, to cause a denial of service condition or the execution of arbitrary code. (CVE-2019-11040)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

An unitialized read was discovered in the XBM support of libgd2, a library for programmatic graphics creation and manipulation. The unitialized read might lead to information disclosure.

For Debian 8 'Jessie', this problem has been fixed in version 2.1.0-5+deb8u13.

We recommend that you upgrade your libgd2 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

**PHP version 7.2.19** (30 May 2019)

**EXIF:**

  - Fixed bug php#77988 (heap-buffer-overflow on     php_jpg_get16). (CVE-2019-11040) (Stas)

**FPM:**

  - Fixed bug php#77934 (php-fpm kill -USR2 not working).
    (Jakub Zelenka)

  - Fixed bug php#77921 (static.php.net doesn't work     anymore). (Peter Kokot)

**GD:**

  - Fixed bug php#77943 (imageantialias($image, false); does     not work). (cmb)

  - Fixed bug php#77973 (Uninitialized read in     gdImageCreateFromXbm). (CVE-2019-11038) (cmb)

**Iconv:**

  - Fixed bug php#78069 (Out-of-bounds read in     iconv.c:_php_iconv_mime_decode() due to integer     overflow). (CVE-2019-11039). (maris dot adam)

**JSON:**

  - Fixed bug php#77843 (Use after free with json     serializer). (Nikita)

**Opcache:**

  - Fixed possible crashes, because of inconsistent PCRE     cache and opcache SHM reset. (Alexey Kalinin, Dmitry)

**PDO_MySQL:**

  - Fixed bug php#77944 (Wrong meta pdo_type for bigint on     LLP64). (cmb)

**Reflection:**

  - Fixed bug php#75186 (Inconsistent reflection of     Closure:::__invoke()). (Nikita)

**Session:**

  - Fixed bug php#77911 (Wrong warning for     session.sid_bits_per_character). (cmb)

**SPL:**

  - Fixed bug php#77024 (SplFileObject::__toString() may     return array). (Craig Duncan)

**SQLite:**

  - Fixed bug php#77967 (Bypassing open_basedir restrictions     via file uris). (Stas)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

**PHP version 7.3.6** (30 May 2019)

**cURL:**

  - Implemented FR php#72189 (Add missing CURL_VERSION_*     constants). (Javier Spagnoletti)

**EXIF:**

  - Fixed bug php#77988 (heap-buffer-overflow on     php_jpg_get16). (CVE-2019-11040) (Stas)

**FPM:**

  - Fixed bug php#77934 (php-fpm kill -USR2 not working).
    (Jakub Zelenka)

  - Fixed bug php#77921 (static.php.net doesn't work     anymore). (Peter Kokot)

**GD:**

  - Fixed bug php#77943 (imageantialias($image, false); does     not work). (cmb)

  - Fixed bug php#77973 (Uninitialized read in     gdImageCreateFromXbm). (CVE-2019-11038) (cmb)

**Iconv:**

  - Fixed bug php#78069 (Out-of-bounds read in     iconv.c:_php_iconv_mime_decode() due to integer     overflow). (CVE-2019-11039). (maris dot adam)

**JSON:**

  - Fixed bug php#77843 (Use after free with json     serializer). (Nikita)

**Opcache:**

  - Fixed possible crashes, because of inconsistent PCRE     cache and opcache SHM reset. (Alexey Kalinin, Dmitry)

**PDO_MySQL:**

  - Fixed bug php#77944 (Wrong meta pdo_type for bigint on     LLP64). (cmb)

**Reflection:**

  - Fixed bug php#75186 (Inconsistent reflection of     Closure:::__invoke()). (Nikita)

**Session:**

  - Fixed bug php#77911 (Wrong warning for     session.sid_bits_per_character). (cmb)

**SOAP:**

  - Fixed bug php#77945 (Segmentation fault when     constructing SoapClient with WSDL_CACHE_BOTH). (Nikita)

**SPL:**

  - Fixed bug php#77024 (SplFileObject::__toString() may     return array). (Craig Duncan)

**SQLite:**

  - Fixed bug php#77967 (Bypassing open_basedir restrictions     via file uris). (Stas)

**Standard:**

  - Fixed bug php#77931 (Warning for array_map mentions     wrong type). (Nikita)

  - Fixed bug php#78003 (strip_tags output change since PHP     7.3). (cmb)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of PHP running on the remote web server is 7.3.x prior to 7.3.6.
It is, therefore, affected by the following vulnerabilities:

  - An uninitialized vulnerability exists in gdImageCreateFromXbm due to sscanf method not being   able to read a hex value. An attacker may be able exploit this issue,   to cause the disclose of sensitive information. (CVE-2019-11038)

  - An out of bounds read vulnerability exists in iconv.c:_php_iconv_mime_decode() due to integer overflow.
  An attacker may be able exploit this issue, to cause the disclose of sensitive information. (CVE-2019-11039)

  - A heap-based buffer overflow condition exists on php_jpg_get16. An attacker can exploit this,   to cause a denial of service condition or the execution of arbitrary code. (CVE-2019-11040)

According to its banner, the version of PHP running on the remote web server is 7.1.x prior to 7.1.30.
It is, therefore, affected by the following vulnerabilities:

  - An uninitialized vulnerability exists in gdImageCreateFromXbm due to sscanf method not being   able to read a hex value. An attacker may be able exploit this issue,   to cause the disclose of sensitive information. (CVE-2019-11038)

  - An out of bounds read vulnerability exists in iconv.c:_php_iconv_mime_decode() due to integer overflow.
  An attacker may be able exploit this issue, to cause the disclose of sensitive information. (CVE-2019-11039)

  - A heap-based buffer overflow condition exists on php_jpg_get16. An attacker can exploit this,   to cause a denial of service condition or the execution of arbitrary code. (CVE-2019-11040)

According to its banner, the version of PHP running on the remote web server is 7.2.x prior to 7.2.19.
It is, therefore, affected by the following vulnerabilities:

  - An uninitialized vulnerability exists in gdImageCreateFromXbm due to sscanf method not being   able to read a hex value. An attacker may be able exploit this issue,   to cause the disclose of sensitive information. (CVE-2019-11038)

  - An out of bounds read vulnerability exists in iconv.c:_php_iconv_mime_decode() due to integer overflow.
  An attacker may be able exploit this issue, to cause the disclose of sensitive information. (CVE-2019-11039)

  - A heap-based buffer overflow condition exists on php_jpg_get16. An attacker can exploit this,   to cause a denial of service condition or the execution of arbitrary code. (CVE-2019-11040)

ID	Name	Product	Family	Severity
183650	Ubuntu 16.04 LTS / 18.04 LTS : GD Graphics Library vulnerabilities (USN-4316-1)	Nessus	Ubuntu Local Security Checks	medium
153325	EulerOS 2.0 SP2 : php (EulerOS-SA-2021-2423)	Nessus	Huawei Local Security Checks	medium
150598	SUSE SLES11 Security Update : php53 (SUSE-SU-2019:14158-1)	Nessus	SuSE Local Security Checks	high
143250	Photon OS 3.0: Libgd PHSA-2020-3.0-0164	Nessus	PhotonOS Local Security Checks	medium
143245	Photon OS 2.0: Libgd PHSA-2020-2.0-0297	Nessus	PhotonOS Local Security Checks	medium
138256	SUSE SLED15 / SLES15 Security Update : gd (SUSE-SU-2020:0594-2)	Nessus	SuSE Local Security Checks	medium
134850	Slackware 14.2 / current : gd (SSA:2020-083-01)	Nessus	Slackware Local Security Checks	critical
134398	openSUSE Security Update : gd (openSUSE-2020-332)	Nessus	SuSE Local Security Checks	medium
134366	SUSE SLED12 / SLES12 Security Update : gd (SUSE-SU-2020:0623-1)	Nessus	SuSE Local Security Checks	medium
134297	SUSE SLED15 / SLES15 Security Update : gd (SUSE-SU-2020:0594-1)	Nessus	SuSE Local Security Checks	medium
131500	EulerOS Virtualization for ARM 64 3.0.3.0 : gd (EulerOS-SA-2019-2335)	Nessus	Huawei Local Security Checks	medium
129433	EulerOS 2.0 SP8 : gd (EulerOS-SA-2019-2074)	Nessus	Huawei Local Security Checks	medium
129107	Debian DSA-4529-1 : php7.0 - security update	Nessus	Debian Local Security Checks	critical
128317	SUSE SLES12 Security Update : php7 (SUSE-SU-2019:2243-1)	Nessus	SuSE Local Security Checks	high
127068	Amazon Linux AMI : php71 / php72,php73 (ALAS-2019-1240)	Nessus	Amazon Linux Local Security Checks	critical
98621	PHP 7.1.x < 7.1.30 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98620	PHP 7.2.x < 7.2.19 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98619	PHP 7.3.x < 7.3.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
125837	Debian DLA-1817-1 : libgd2 security update	Nessus	Debian Local Security Checks	medium
125787	Fedora 29 : php (2019-8c4b25b5ec)	Nessus	Fedora Local Security Checks	critical
125747	Fedora 30 : php (2019-be4f895015)	Nessus	Fedora Local Security Checks	critical
125681	PHP 7.3.x < 7.3.6 Multiple Vulnerabilities.	Nessus	CGI abuses	critical
125640	PHP 7.1.x < 7.1.30 Multiple Vulnerabilities.	Nessus	CGI abuses	critical
125639	PHP 7.2.x < 7.2.19 Multiple Vulnerabilities.	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2019-11038

medium

Tenable Plugins

medium

medium

high

medium

medium

medium

critical

medium

medium

medium

medium

medium

critical

high

critical

critical

critical

critical

medium

critical

critical

critical

critical

critical