kritik
CVE-2019-11037
php-imagick: out-of-bounds write to memory in ImagickKernel::fromMatrix() leading to possible crash and DoS
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: Red Hat (orta), Amazon (orta), Ubuntu (orta).
Açıklama
In PHP imagick extension in versions between 3.3.0 and 3.4.4, writing to an array of values in ImagickKernel::fromMatrix() function did not check that the address will be within the allocated array. This could lead to out of bounds write to memory if the function is called with the data controlled by untrusted party.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| alpine 3.11 | php7-pecl-imagick | 3.4.4-r0 |
| alpine 3.12 | php7-pecl-imagick | 3.4.4-r0 |
| alpine 3.13 | php7-pecl-imagick | 3.4.4-r0 |
| alpine 3.14 | php7-pecl-imagick | 3.4.4-r0 |
| alpine 3.15 | php7-pecl-imagick | 3.4.4-r0 |
| amazon linux 1 | php54-pecl-imagick, php54-pecl-imagick-debuginfo, php55-pecl-imagick ve 12 tane daha | 3.4.4-1.10.amzn1 ve 5 tane daha |
| debian 11 | php-imagick | 3.4.3-4.1 |
| debian 12 | php-imagick | 3.4.3-4.1 |
| debian 13 | php-imagick | 3.4.3-4.1 |
| debian 14 | php-imagick | 3.4.3-4.1 |
| debian 9 | php-imagick | 3.4.3~rc2-2+deb9u1 |
| echo | php-imagick | 3.4.3-4.1 |
15 kaynaktaki 29 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| alpine 3.11 | php7-pecl-imagick | 3.4.4-r0 |
| alpine 3.12 | php7-pecl-imagick | 3.4.4-r0 |
| alpine 3.13 | php7-pecl-imagick | 3.4.4-r0 |
| alpine 3.14 | php7-pecl-imagick | 3.4.4-r0 |
| alpine 3.15 | php7-pecl-imagick | 3.4.4-r0 |
| amazon linux 1 | php54-pecl-imagick | 3.4.4-1.10.amzn1 |
| amazon linux 1 | php54-pecl-imagick-debuginfo | 3.4.4-1.10.amzn1 |
| amazon linux 1 | php55-pecl-imagick | 3.4.4-1.14.amzn1 |
| amazon linux 1 | php55-pecl-imagick-debuginfo | 3.4.4-1.14.amzn1 |
| amazon linux 1 | php56-pecl-imagick | 3.4.4-1.15.amzn1 |
| amazon linux 1 | php56-pecl-imagick-debuginfo | 3.4.4-1.15.amzn1 |
| amazon linux 1 | php70-pecl-imagick | 3.4.4-1.6.amzn1 |
| amazon linux 1 | php70-pecl-imagick-debuginfo | 3.4.4-1.6.amzn1 |
| amazon linux 1 | php70-pecl-imagick-devel | 3.4.4-1.6.amzn1 |
| amazon linux 1 | php71-pecl-imagick | 3.4.4-1.7.amzn1 |
| amazon linux 1 | php71-pecl-imagick-debuginfo | 3.4.4-1.7.amzn1 |
| amazon linux 1 | php71-pecl-imagick-devel | 3.4.4-1.7.amzn1 |
| amazon linux 1 | php72-pecl-imagick | 3.4.4-1.9.amzn1 |
| amazon linux 1 | php72-pecl-imagick-debuginfo | 3.4.4-1.9.amzn1 |
| amazon linux 1 | php72-pecl-imagick-devel | 3.4.4-1.9.amzn1 |
| debian 11 | php-imagick | 3.4.3-4.1 |
| debian 12 | php-imagick | 3.4.3-4.1 |
| debian 13 | php-imagick | 3.4.3-4.1 |
| debian 14 | php-imagick | 3.4.3-4.1 |
| debian 9 | php-imagick | 3.4.3~rc2-2+deb9u1 |
| echo | php-imagick | 3.4.3-4.1 |
| ubuntu 16.04-ESM | php-imagick | 3.4.0~rc6-1ubuntu3+esm1 |
| ubuntu 18.04 | php-imagick | 3.4.3~rc2-2ubuntu4.1 |
| ubuntu 18.04-ESM | php-imagick | 3.4.3~rc2-2ubuntu4.1 |
Referanslar
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00016.html
- http://www.securityfocus.com/bid/108292
- https://access.redhat.com/security/cve/CVE-2019-11037
- https://bugs.php.net/bug.php?id=77791
- https://github.com/CVEProject/cvelist/pull/1964
- https://github.com/mkoppanen/imagick/commits/bugfix_77791
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7MQ7WJA25YF2R2LRALK4QEYWUHHJPSUD/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BU66V7QJKD32RXLY5J7Z5NZH4V3VV524/
17 referansın hepsi
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FME5ZG7DDYWUPPHTTAFJB5OFFCPXYHPS/
- https://nvd.nist.gov/vuln/detail/CVE-2019-11037
- https://seclists.org/bugtraq/2019/Nov/39
- https://security.gentoo.org/glsa/202003-38
- https://ubuntu.com/security/notices/USN-4586-1
- https://ubuntu.com/security/notices/USN-4586-2
- https://usn.ubuntu.com/4586-1/
- https://www.cve.org/CVERecord?id=CVE-2019-11037
- https://www.debian.org/security/2019/dsa-4576