CVEvulnerability
CVE-2019-11041
7.1 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-08-09
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
- CVSS 3.0 ([email protected])
- 4.8 MEDIUM — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
- CVSS 2.0 ([email protected])
- 5.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:P
- Weaknesses
- CWE-125
Description
When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.
Affected configurations
• php php (>= 7.1.0 < 7.1.31)
• php php (>= 7.2.0 < 7.2.21)
• php php (>= 7.3.0 < 7.3.8)
• debian debian linux 8.0
• debian debian linux 9.0
• debian debian linux 10.0
• canonical ubuntu linux 12.04
• canonical ubuntu linux 14.04
• canonical ubuntu linux 16.04
• canonical ubuntu linux 18.04
• canonical ubuntu linux 19.04
• apple mac os x (< 10.15.1)
• opensuse leap 15.0
• redhat software collections 1.0
• tenable tenable.sc (< 5.19.0)
Related
Weakness · CWE (1)
- CWE-125 Out-of-bounds Read weakness
References
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00019.html Third Party Advisory
- http://seclists.org/fulldisclosure/2019/Oct/15 Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2019/Oct/55 Mailing List, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3299 Third Party Advisory
- https://bugs.php.net/bug.php?id=78222 Exploit, Patch, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2019/08/msg00010.html Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2019/Oct/9 Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2019/Sep/35 Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2019/Sep/38 Mailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20190822-0003/ Third Party Advisory
- https://support.apple.com/kb/HT210634 Third Party Advisory
- https://support.apple.com/kb/HT210722 Third Party Advisory
- https://usn.ubuntu.com/4097-1/ Third Party Advisory
- https://usn.ubuntu.com/4097-2/ Third Party Advisory
- https://www.debian.org/security/2019/dsa-4527 Third Party Advisory
- https://www.debian.org/security/2019/dsa-4529 Third Party Advisory
- https://www.tenable.com/security/tns-2021-14 Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00019.html Third Party Advisory
- http://seclists.org/fulldisclosure/2019/Oct/15 Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2019/Oct/55 Mailing List, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3299 Third Party Advisory
- https://bugs.php.net/bug.php?id=78222 Exploit, Patch, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2019/08/msg00010.html Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2019/Oct/9 Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2019/Sep/35 Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2019/Sep/38 Mailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20190822-0003/ Third Party Advisory
- https://support.apple.com/kb/HT210634 Third Party Advisory
- https://support.apple.com/kb/HT210722 Third Party Advisory
- https://usn.ubuntu.com/4097-1/ Third Party Advisory
- https://usn.ubuntu.com/4097-2/ Third Party Advisory
- https://www.debian.org/security/2019/dsa-4527 Third Party Advisory
- https://www.debian.org/security/2019/dsa-4529 Third Party Advisory
- https://www.tenable.com/security/tns-2021-14 Third Party Advisory