Uninitialized read in gdImageCreateFromXbm

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• php php7.1.0 and later · before 7.1.30
• php php7.2.0 and later · before 7.2.19
• php php7.3.0 and later · before 7.3.6

Versions reported by the vendor

Affected version ranges reported by the assigning authority (php). Independent of NVD's CPE analysis and usually ahead of it.

• PHP Group PHP

  • 7.1.x < 7.1.30, 7.2.x < 7.2.19, 7.3.x < 7.3.6affected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2019-6977gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch function in PHP before 5.
  56Plan
• CVE-2016-3074Integer signedness error in GD Graphics Library 2.1.1 (aka libgd or libgd2) allows remote attackers to cause a denial of service (crash) or
  50Plan
• CVE-2016-10166Integer underflow in the _gdContributionsAlloc function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.4 allows rem
  42Plan
• CVE-2016-7568Integer overflow in the gdImageWebpCtx function in gd_webp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP through 7.
  41Plan
• CVE-2019-6978The GD Graphics Library (aka LibGD) 2.2.5 has a double free in the gdImage*Ptr() functions in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c.
  40Plan
• CVE-2016-6912Double free vulnerability in the gdImageWebPtr function in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have
  40Plan

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.