CVEvulnerability
CVE-2019-11035
9.1 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2019-04-18
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- CVSS 3.0 ([email protected])
- 4.8 MEDIUM — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
- CVSS 2.0 ([email protected])
- 6.4 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:P
- Weaknesses
- CWE-125
Description
When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_iif_add_value function. This may lead to information disclosure or crash.
Affected configurations
• php php (>= 7.1.0 < 7.1.28)
• php php (>= 7.2.9 < 7.2.17)
• php php (>= 7.3.0 < 7.3.4)
• canonical ubuntu linux 12.04
• canonical ubuntu linux 14.04
• canonical ubuntu linux 16.04
• canonical ubuntu linux 18.04
• canonical ubuntu linux 18.10
• canonical ubuntu linux 19.04
• netapp storage automation store
• redhat software collections 1.0
• opensuse leap 15.0
• opensuse leap 15.1
• opensuse leap 42.3
• debian debian linux 8.0
• debian debian linux 9.0
Related
Weakness · CWE (1)
- CWE-125 Out-of-bounds Read weakness
References
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00010.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00012.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html Mailing List, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2519 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3299 Third Party Advisory
- https://bugs.php.net/bug.php?id=77831 Exploit, Mailing List, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2019/05/msg00035.html Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2019/Sep/38 Mailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20190502-0001/ Patch, Third Party Advisory
- https://support.f5.com/csp/article/K44590877 Third Party Advisory
- https://usn.ubuntu.com/3953-1/ Third Party Advisory
- https://usn.ubuntu.com/3953-2/ Third Party Advisory
- https://www.debian.org/security/2019/dsa-4529 Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00010.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00012.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html Mailing List, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2519 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3299 Third Party Advisory
- https://bugs.php.net/bug.php?id=77831 Exploit, Mailing List, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2019/05/msg00035.html Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2019/Sep/38 Mailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20190502-0001/ Patch, Third Party Advisory
- https://support.f5.com/csp/article/K44590877 Third Party Advisory
- https://usn.ubuntu.com/3953-1/ Third Party Advisory
- https://usn.ubuntu.com/3953-2/ Third Party Advisory
- https://www.debian.org/security/2019/dsa-4529 Third Party Advisory