CVE-2019-6977: Buffer Overflow
Fixed bug (imagecolormatch Out Of Bounds Write on Heap). (CVE-2019-6977)
Other sources
gdImageColorMatch in gdcolormatch.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch function in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1, has a heap-based buffer overflow. This can be exploited by an attacker who is able to trigger imagecolormatch calls with crafted image data.
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-6977?
CVE-2019-6977 is a vulnerability in the GD Graphics Library (LibGD) that allows an attacker to trigger a heap-based buffer overflow.
Which software versions are affected by CVE-2019-6977?
CVE-2019-6977 affects PHP versions before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1, as well as LibGD version 2.2.5.
How severe is CVE-2019-6977?
CVE-2019-6977 has a severity score of 8.8 (high).
How can I fix CVE-2019-6977?
To fix CVE-2019-6977, update your PHP version to 5.6.40 or later, 7.1.26 or later, 7.2.14 or later, or 7.3.1 or later. Additionally, update your LibGD version to 2.2.5-7.el8 or later.
Where can I find more information about CVE-2019-6977?
You can find more information about CVE-2019-6977 at the following references: [link1], [link2], [link3].