CVEvulnerability
CVE-2019-11036
9.1 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2019-05-03
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- CVSS 3.0 ([email protected])
- 4.8 MEDIUM — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
- CVSS 2.0 ([email protected])
- 6.4 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:P
- Weaknesses
- CWE-125, CWE-126
Description
When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.29, 7.2.x below 7.2.18 and 7.3.x below 7.3.5 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash.
Affected configurations
• php php (>= 7.1.0 < 7.1.29)
• php php (>= 7.2.0 < 7.2.18)
• php php (>= 7.3.0 < 7.3.5)
• fedoraproject fedora 28
• fedoraproject fedora 29
• fedoraproject fedora 30
• redhat software collections 1.0
• canonical ubuntu linux 12.04
• canonical ubuntu linux 14.04
• canonical ubuntu linux 16.04
• canonical ubuntu linux 18.04
• canonical ubuntu linux 18.10
• canonical ubuntu linux 19.04
• debian debian linux 8.0
• debian debian linux 9.0
• debian debian linux 10.0
• opensuse leap 15.0
• opensuse leap 15.1
• opensuse leap 42.3
Related
References
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00010.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00012.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/108177 Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2019:2519 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3299 Third Party Advisory
- https://bugs.php.net/bug.php?id=77950 Mailing List, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2019/05/msg00035.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2NFXYNCXZCPYT7ZN4ZLI5EPQQW44FRRO/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3BY2XUUAN277LS7HKAOGL4DVGAELOJV3/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WN2HLPGEZEF4MFM5YC5FILZB5QEQFP3A/ lists.fedoraproject.org
- https://seclists.org/bugtraq/2019/Sep/35 Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2019/Sep/38 Mailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20190517-0003/ Third Party Advisory
- https://usn.ubuntu.com/3566-2/ Third Party Advisory
- https://usn.ubuntu.com/4009-1/ Third Party Advisory
- https://www.debian.org/security/2019/dsa-4527 Third Party Advisory
- https://www.debian.org/security/2019/dsa-4529 Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00010.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00012.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/108177 Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2019:2519 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3299 Third Party Advisory
- https://bugs.php.net/bug.php?id=77950 Mailing List, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2019/05/msg00035.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2NFXYNCXZCPYT7ZN4ZLI5EPQQW44FRRO/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3BY2XUUAN277LS7HKAOGL4DVGAELOJV3/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WN2HLPGEZEF4MFM5YC5FILZB5QEQFP3A/ lists.fedoraproject.org
- https://seclists.org/bugtraq/2019/Sep/35 Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2019/Sep/38 Mailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20190517-0003/ Third Party Advisory
- https://usn.ubuntu.com/3566-2/ Third Party Advisory
- https://usn.ubuntu.com/4009-1/ Third Party Advisory
- https://www.debian.org/security/2019/dsa-4527 Third Party Advisory
- https://www.debian.org/security/2019/dsa-4529 Third Party Advisory