1. CVE-Search
  2. CVE-2019-11037
ID CVE-2019-11037
Summary In PHP imagick extension in versions between 3.3.0 and 3.4.4, writing to an array of values in ImagickKernel::fromMatrix() function did not check that the address will be within the allocated array. This could lead to out of bounds write to memory if the function is called with the data controlled by untrusted party.
References
Vulnerable Configurations
  • cpe:2.3:a:php:imagick:3.3.0:*:*:*:*:*:*:*
    cpe:2.3:a:php:imagick:3.3.0:*:*:*:*:*:*:*
  • cpe:2.3:a:php:imagick:3.4.0:-:*:*:*:*:*:*
    cpe:2.3:a:php:imagick:3.4.0:-:*:*:*:*:*:*
  • cpe:2.3:a:php:imagick:3.4.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:php:imagick:3.4.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:php:imagick:3.4.0:rc2:*:*:*:*:*:*
    cpe:2.3:a:php:imagick:3.4.0:rc2:*:*:*:*:*:*
  • cpe:2.3:a:php:imagick:3.4.0:rc3:*:*:*:*:*:*
    cpe:2.3:a:php:imagick:3.4.0:rc3:*:*:*:*:*:*
  • cpe:2.3:a:php:imagick:3.4.0:rc4:*:*:*:*:*:*
    cpe:2.3:a:php:imagick:3.4.0:rc4:*:*:*:*:*:*
  • cpe:2.3:a:php:imagick:3.4.0:rc5:*:*:*:*:*:*
    cpe:2.3:a:php:imagick:3.4.0:rc5:*:*:*:*:*:*
  • cpe:2.3:a:php:imagick:3.4.0:rc6:*:*:*:*:*:*
    cpe:2.3:a:php:imagick:3.4.0:rc6:*:*:*:*:*:*
  • cpe:2.3:a:php:imagick:3.4.1:*:*:*:*:*:*:*
    cpe:2.3:a:php:imagick:3.4.1:*:*:*:*:*:*:*
  • cpe:2.3:a:php:imagick:3.4.2:*:*:*:*:*:*:*
    cpe:2.3:a:php:imagick:3.4.2:*:*:*:*:*:*:*
  • cpe:2.3:a:php:imagick:3.4.3:-:*:*:*:*:*:*
    cpe:2.3:a:php:imagick:3.4.3:-:*:*:*:*:*:*
  • cpe:2.3:a:php:imagick:3.4.3:rc1:*:*:*:*:*:*
    cpe:2.3:a:php:imagick:3.4.3:rc1:*:*:*:*:*:*
  • cpe:2.3:a:php:imagick:3.4.3:rc2:*:*:*:*:*:*
    cpe:2.3:a:php:imagick:3.4.3:rc2:*:*:*:*:*:*
  • cpe:2.3:a:php:imagick:3.4.3:rc3:*:*:*:*:*:*
    cpe:2.3:a:php:imagick:3.4.3:rc3:*:*:*:*:*:*
  • cpe:2.3:a:php:imagick:3.4.3:rc4:*:*:*:*:*:*
    cpe:2.3:a:php:imagick:3.4.3:rc4:*:*:*:*:*:*
  • cpe:2.3:a:php:imagick:3.4.4:-:*:*:*:*:*:*
    cpe:2.3:a:php:imagick:3.4.4:-:*:*:*:*:*:*
  • cpe:2.3:a:php:imagick:3.4.4:rc2:*:*:*:*:*:*
    cpe:2.3:a:php:imagick:3.4.4:rc2:*:*:*:*:*:*
CVSS
Base: 7.5 (as of 23-10-2020 - 01:15)
Impact:
Exploitability:
CWE CWE-787
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:P
refmap via4
bid 108292
bugtraq 20191126 [SECURITY] [DSA 4576-1] php-imagick security update
debian DSA-4576
fedora
  • FEDORA-2019-488d0f9a4b
  • FEDORA-2019-5dc1f4100e
  • FEDORA-2019-9448fa46f3
gentoo GLSA-202003-38
misc
suse openSUSE-SU-2020:0014
ubuntu USN-4586-1
Last major update 23-10-2020 - 01:15
Published 03-05-2019 - 20:29
Last modified 23-10-2020 - 01:15
Back to Top