Published: 03/05/2019 Updated: 07/11/2023

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

In PHP imagick extension in versions between 3.3.0 and 3.4.4, writing to an array of values in ImagickKernel::fromMatrix() function did not check that the address will be within the allocated array. This could lead to out of bounds write to memory if the function is called with the data controlled by untrusted party.

Vulnerable Product	Search on Vulmon	Subscribe to Product
php imagick

Debian Bug report logs - #928420 php-imagick: CVE-2019-11037 Package: src:php-imagick; Maintainer for src:php-imagick is Debian PHP PECL Maintainers <team+php-pecl@trackerdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 4 May 2019 08:42:02 UTC Severity: grave Tags: fixed-upstream, patch ...

An out-of-bounds write vulnerability was discovered in php-imagick, a PHP extension to create and modify images using the ImageMagick API, which could result in denial of service, or potentially the execution of arbitrary code For the oldstable distribution (stretch), this problem has been fixed in version 343~rc2-2+deb9u1 We recommend that you ...

In PHP imagick extension, writing to an array of values in ImagickKernel::fromMatrix() function did not check that the address will be within the allocated array This could lead to out of bounds write to memory if the function is called with the data controlled by untrusted party (CVE-2019-11037) ...

Impact: Moderate Public Date: 2019-05-04 CWE: CWE-787 Bugzilla: 1708570: CVE-2019-11037 php-imagick: ou ...

CWE-787 https://bugs.php.net/bug.php?id=77791 http://www.securityfocus.com/bid/108292 https://github.com/CVEProject/cvelist/pull/1964 https://www.debian.org/security/2019/dsa-4576 https://seclists.org/bugtraq/2019/Nov/39 http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00016.html https://security.gentoo.org/glsa/202003-38 https://usn.ubuntu.com/4586-1/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7MQ7WJA25YF2R2LRALK4QEYWUHHJPSUD/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BU66V7QJKD32RXLY5J7Z5NZH4V3VV524/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FME5ZG7DDYWUPPHTTAFJB5OFFCPXYHPS/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=928420 https://nvd.nist.gov https://www.debian.org/security/2019/dsa-4576

CVE-2019-11037

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect