Out-of-bounds write in PHP - CVE-2019-6977
Published: January 10, 2019 / Updated: June 17, 2021
Vulnerability identifier: #VU16916
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-6977
CWE-ID: CWE-787
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary on the target system.
The weakness exists due to out-of-bounds write in imagecolormatch. A remote attacker can write up to 1200 bytes over the boundaries of a buffer allocated in the imagecolormatch function, which then calls gdImageColorMatch() and execute arbitrary code with elevated privileges.
The weakness exists due to out-of-bounds write in imagecolormatch. A remote attacker can write up to 1200 bytes over the boundaries of a buffer allocated in the imagecolormatch function, which then calls gdImageColorMatch() and execute arbitrary code with elevated privileges.
Affected software
PHP
Gentoo Linux
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Slackware Linux
Opensuse
Fedora
Red Hat Software Collections
libgd2 (Ubuntu package)
libgd2 (Debian package)
php7 (Alpine package)
gd (Red Hat package)
gd
Flex System Chassis Management Module (CMM)
Gentoo Linux
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Slackware Linux
Opensuse
Fedora
Red Hat Software Collections
libgd2 (Ubuntu package)
libgd2 (Debian package)
php7 (Alpine package)
gd (Red Hat package)
gd
Flex System Chassis Management Module (CMM)
How to mitigate CVE-2019-6977
The vulnerability has been fixed in the versions 5.6.40, 7.1.26, 7.2.14, 7.3.1.
PHP - addressed in versions 5.6.40, 7.1.26, 7.2.14, 7.3.1
libgd2 (Ubuntu package) - addressed in versions 2.1.0-3ubuntu0.11, 2.1.1-4ubuntu0.16.04.11, 2.2.5-4ubuntu0.3, 2.2.5-4ubuntu1.1
libgd2 (Debian package) - update to 2.2.4-2+deb9u4
php7 (Alpine package) - update to 7.1.30-r0
Flex System Chassis Management Module (CMM) - update to 2pet18c-2.5.16c
gd (Red Hat package) - update to 2.2.5-7.el8
gd - addressed in versions 2.2.5-8.fc29, 2.2.5-9.fc30, 2.2.5-10.fc31, 2.3.0-1.fc32
libgd2 (Ubuntu package) - addressed in versions 2.1.0-3ubuntu0.11, 2.1.1-4ubuntu0.16.04.11, 2.2.5-4ubuntu0.3, 2.2.5-4ubuntu1.1
libgd2 (Debian package) - update to 2.2.4-2+deb9u4
php7 (Alpine package) - update to 7.1.30-r0
Flex System Chassis Management Module (CMM) - update to 2pet18c-2.5.16c
gd (Red Hat package) - update to 2.2.5-7.el8
gd - addressed in versions 2.2.5-8.fc29, 2.2.5-9.fc30, 2.2.5-10.fc31, 2.3.0-1.fc32
Links to Public Exploits and PoC-codes
External References
Related Security Bulletins
- Multiple vulnerabilities in PHP
- Debian update for libgd2
- OpenSUSE Linux update for php7
- Ubuntu update for GD
- OpenSUSE Linux update for gd
- OpenSUSE Linux update for gd
- OpenSUSE Linux update for php5
- Gentoo update for GD
- Red Hat update for rh-php72-php
- Slackware Linux update for gd
- Out-of-bounds write in php7 (Alpine package)
- Red Hat Enterprise Linux 8 update for gd
- Multiple vulnerabilities in IBM Flex System Chassis Management Module (CMM)
- Fedora 29 update for gd
- Fedora 30 update for gd
- Fedora 31 update for gd
- Fedora 32 update for gd