CVE-2019-6977

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-6977
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-6977.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-6977
Downstream
Related
Published
2019-01-27T02:29:00.340Z
Modified
2026-07-08T05:55:07.654080748Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

gdImageColorMatch in gdcolormatch.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch function in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1, has a heap-based buffer overflow. This can be exploited by an attacker who is able to trigger imagecolormatch calls with crafted image data.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "CPE_STRING",
            "vendor_product": "canonical:ubuntu_linux",
            "extracted_events": [
                {
                    "introduced": "14.04"
                },
                {
                    "last_affected": "14.04"
                },
                {
                    "introduced": "16.04"
                },
                {
                    "last_affected": "16.04"
                },
                {
                    "introduced": "18.04"
                },
                {
                    "last_affected": "18.04"
                },
                {
                    "introduced": "18.10"
                },
                {
                    "last_affected": "18.10"
                }
            ],
            "cpes": [
                "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*"
            ]
        },
        {
            "source": "CPE_STRING",
            "vendor_product": "debian:debian_linux",
            "extracted_events": [
                {
                    "introduced": "8.0"
                },
                {
                    "last_affected": "8.0"
                },
                {
                    "introduced": "9.0"
                },
                {
                    "last_affected": "9.0"
                }
            ],
            "cpes": [
                "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
            ]
        }
    ]
}
References

Affected packages

Git / github.com/libgd/libgd

Affected ranges

Type
GIT
Repo
https://github.com/libgd/libgd
Events
Introduced
8255231b68889597d04d451a72438ab92a405aba
Last affected
8255231b68889597d04d451a72438ab92a405aba
Database specific 
{
    "cpe": "cpe:2.3:a:libgd:libgd:2.2.5:*:*:*:*:*:*:*",
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "2.2.5"
        },
        {
            "last_affected": "2.2.5"
        }
    ]
}

Affected versions

2.*
2.2.5
gd-2.*
gd-2.2.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-6977.json"

Git / github.com/php/php-src

Affected ranges

Type
GIT
Repo
https://github.com/php/php-src
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4b8f72da5dfb201af4e82dee960261d8657e414f
Introduced
60fffd296abce5fc071f3c173c25a2696cf683c6
Fixed
b3ad2be890e86c69cdc661739c74b677b46a53cb
Introduced
8148cbb78841c8ec0759c0836e7f35dec799d300
Fixed
643a161a24e662fd2afa9bf3591b105f4881e93e
Introduced
52ace952a1b65ca80fc2617f11c2fa6dd03f51bd
Last affected
52ace952a1b65ca80fc2617f11c2fa6dd03f51bd
Database specific 
{
    "cpe": [
        "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:php:php:7.3.0:*:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.6.40"
        },
        {
            "introduced": "7.0.0"
        },
        {
            "fixed": "7.1.26"
        },
        {
            "introduced": "7.2.0"
        },
        {
            "fixed": "7.2.14"
        },
        {
            "introduced": "7.3.0"
        },
        {
            "last_affected": "7.3.0"
        }
    ]
}

Affected versions

7.*
7.3.0
Other
POST_64BIT_BRANCH_MERGE
POST_AST_MERGE
POST_PHP7_NSAPI_REMOVAL
POST_PHP7_REMOVALS
POST_PHPNG_MERGE
PRE_64BIT_BRANCH_MERGE
PRE_AST_MERGE
PRE_PHP7_EREG_MYSQL_REMOVALS
PRE_PHP7_NSAPI_REMOVAL
PRE_PHP7_REMOVALS
php-7.*
php-7.3.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-6977.json"