CVEvulnerability
CVE-2019-11034
9.1 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2019-04-18
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- CVSS 3.0 ([email protected])
- 4.8 MEDIUM — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
- CVSS 2.0 ([email protected])
- 6.4 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:P
- Weaknesses
- CWE-125
Description
When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash.
Affected configurations
• php php (>= 7.1.0 < 7.1.28)
• php php (>= 7.2.9 < 7.2.17)
• php php (>= 7.3.0 < 7.3.4)
• canonical ubuntu linux 12.04
• canonical ubuntu linux 14.04
• canonical ubuntu linux 16.04
• canonical ubuntu linux 18.04
• canonical ubuntu linux 18.10
• canonical ubuntu linux 19.04
• netapp storage automation store
• redhat software collections 1.0
• debian debian linux 8.0
• debian debian linux 9.0
• opensuse leap 15.0
• opensuse leap 15.1
• opensuse leap 42.3
Related
Weakness · CWE (1)
- CWE-125 Out-of-bounds Read weakness
References
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00010.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00012.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html Mailing List, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2519 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3299 Third Party Advisory
- https://bugs.php.net/bug.php?id=77753 Patch, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2019/05/msg00035.html Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2019/Sep/38 Mailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20190502-0001/ Third Party Advisory
- https://support.f5.com/csp/article/K44590877 Third Party Advisory
- https://usn.ubuntu.com/3953-1/ Third Party Advisory
- https://usn.ubuntu.com/3953-2/ Third Party Advisory
- https://www.debian.org/security/2019/dsa-4529 Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00010.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00012.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html Mailing List, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2519 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3299 Third Party Advisory
- https://bugs.php.net/bug.php?id=77753 Patch, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2019/05/msg00035.html Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2019/Sep/38 Mailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20190502-0001/ Third Party Advisory
- https://support.f5.com/csp/article/K44590877 Third Party Advisory
- https://usn.ubuntu.com/3953-1/ Third Party Advisory
- https://usn.ubuntu.com/3953-2/ Third Party Advisory
- https://www.debian.org/security/2019/dsa-4529 Third Party Advisory