Description
When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been left there by previous code.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| PHP Group | PHP | 7.1.x < 7.1.30, 7.2.x < 7.2.19, 7.3.x < 7.3.6 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libgd2 | 2.2.5-5.2 | — |
| Debian 13 | libgd2 | 2.2.5-5.2 | — |
| Debian 12 | libgd2 | 2.2.5-5.2 | — |
| Debian 9 | php7.0 | 7.0.33-0+deb9u5 | DSA-4529-1 |
| Debian 8 | libgd2 | 2.1.0-5+deb8u13 | DLA-1817-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | libgd2 | 2.2.5-4ubuntu0.4 | USN-4316-1 |
| Ubuntu 16.04 LTS | libgd2 | 2.1.1-4ubuntu0.16.04.12 | USN-4316-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | libgd2 | 2.1.0-3ubuntu0.11+esm1 | USN-4316-2 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | rh-php71-php +27 | 7.1.30-1.el7 | RHSA-2019:2519 |
| RHEL 3 | rh-php72-php +27 | 7.2.24-1.el7 | RHSA-2019:3299 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | gd | 2.2.5-4.14.1 | SUSE-SU-2020:0594-2, SUSE-SU-2020:0594-1 |
| SLES 12 SP5 | gd | 2.1.0-24.17.1 | SUSE-SU-2020:0623-1 |
| SLES 12 SP4 | gd | 2.1.0-24.17.1 | SUSE-SU-2020:0623-1 |
| SLES 12 SP4 | php7 | 7.0.7-50.85.1 | SUSE-SU-2019:2243-1 |
| SLES 12 | php7 | 7.0.7-50.85.1 | SUSE-SU-2019:2243-1 |
| SLES 11 SP4 | php53 | 5.3.17-112.71.1 | SUSE-SU-2019:14158-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP5 | gd | 2.1.0-24.17.1 | SUSE-SU-2020:0623-1 |
| SLES for SAP 12 SP4 | gd | 2.1.0-24.17.1 | SUSE-SU-2020:0623-1 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | php53 | 5.3.17-112.71.1 | SUSE-SU-2019:14158-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | gd | 2.3.3-1.1 | openSUSE-SU-2024:10777-1 |
| openSUSE Leap 15.1 | gd | 2.2.5-lp151.6.6.1 | openSUSE-SU-2020:0332-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | gd | 2.3.0-r0 | — |
| Alpine v3.23 | gd | 2.3.0-r0 | — |
| Alpine v3.22 | gd | 2.3.0-r0 | — |
| Alpine v3.21 | gd | 2.3.0-r0 | — |
| Alpine v3.20 | gd | 2.3.0-r0 | — |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | gd | 2.3.0-r0 | — |
| Alpine v3.18 | gd | 2.3.0-r0 | — |
| Alpine v3.17 | gd | 2.3.0-r0 | — |
| Alpine v3.16 | gd | 2.3.0-r0 | — |
| Alpine v3.15 | gd | 2.3.0-r0 | — |
| Alpine v3.14 | gd | 2.3.0-r0 | — |
| Alpine v3.13 | gd | 2.3.0-r0 | — |
| Alpine v3.12 | gd | 2.3.0-r0 | — |
| Alpine v3.11 | gd | 2.2.5-r3 | — |
| Alpine v3.10 | gd | 2.2.5-r3 | — |
| Alpine v3.9 | gd | 2.2.5-r3 | — |
| Alpine v3.8 | gd | 2.2.5-r3 | — |
| Alpine v3.7 | php7 | 7.1.30-r0 | — |
Advisories 13
- RHSA-2019:3299 Red Hat Security Advisory: rh-php72-php security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2019:2519 Red Hat Security Advisory: rh-php71-php security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- USN-4316-2 libgd2 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- USN-4316-1 libgd2 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-4529-1 php7.0 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1817-1 libgd2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2019:14158-1 Security update for php53 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:0594-1 Security update for gd SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:0623-1 Security update for gd SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:0594-2 Security update for gd SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:0332-1 Security update for gd SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10777-1 gd-2.3.3-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2243-1 Security update for php7 SUSE / openSUSE Security Updates · May 2, 2025
References
- FEDORA-2019-be4f895015 vendor-advisory
- FEDORA-2019-8c4b25b5ec vendor-advisory
- [debian-lts-announce] 20190611 [SECURITY] [DLA 1817-1] libgd2 security update mailing-list
- https://bugs.php.net/bug.php?id=77973
- https://github.com/libgd/libgd/issues/501
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=929821
- https://bugzilla.suse.com/show_bug.cgi?id=1140118
- https://bugzilla.suse.com/show_bug.cgi?id=1140120
- https://bugzilla.redhat.com/show_bug.cgi?id=1724149
- https://bugzilla.redhat.com/show_bug.cgi?id=1724432
- RHSA-2019:2519 vendor-advisory
- DSA-4529 vendor-advisory
- 20190923 [SECURITY] [DSA 4529-1] php7.0 security update mailing-list
- RHSA-2019:3299 vendor-advisory
- openSUSE-SU-2020:0332 vendor-advisory
- FEDORA-2020-e795f92d79 vendor-advisory
- USN-4316-2 vendor-advisory
- USN-4316-1 vendor-advisory