CVE-2019-11037: php group php imagick extension Out-of-bounds Write

Vulnerability summary

CVE-2019-11037 is a critical (CVSS 9.8) Out-of-bounds Write vulnerability in php group php imagick extension. EPSS estimates a 1.97% chance of exploitation in the next 30 days, higher than 80.1% of scored vulnerabilities.

Timeline

1. 03-05-2019
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

In PHP imagick extension in versions between 3.3.0 and 3.4.4, writing to an array of values in ImagickKernel::fromMatrix() function did not check that the address will be within the allocated array. This could lead to out of bounds write to memory if the function is called with the data controlled by untrusted party.

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.