CVEvulnerability
CVE-2019-11046
5.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2019-12-23
- Last modified
- 2026-08-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 3.7 LOW — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- CVSS 3.1 ([email protected])
- 5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-125
Description
In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, including Windows, can be tricked into reading beyond the allocated space by supplying it with string containing characters that are identified as numeric by the OS but aren't ASCII numbers. This can read to disclosure of the content of some memory locations.
Affected configurations
• php php (>= 7.2.0 <= 7.2.26)
• php php (>= 7.3.0 <= 7.3.13)
• php php 7.4.0
• debian debian linux 8.0
• debian debian linux 9.0
• debian debian linux 10.0
• fedoraproject fedora 30
• fedoraproject fedora 31
• opensuse leap 15.1
• canonical ubuntu linux 12.04
• canonical ubuntu linux 14.04
• canonical ubuntu linux 16.04
• canonical ubuntu linux 18.04
• canonical ubuntu linux 19.04
• canonical ubuntu linux 19.10
• tenable security center (< 5.19.0)
Related
Weakness · CWE (1)
- CWE-125 Out-of-bounds Read weakness
References
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00036.html Third Party Advisory
- https://bugs.php.net/bug.php?id=78878 Mailing List, Patch, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2019/12/msg00034.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/ lists.fedoraproject.org
- https://seclists.org/bugtraq/2020/Feb/27 Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2020/Feb/31 Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2021/Jan/3 Mailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20200103-0002/ Third Party Advisory
- https://support.f5.com/csp/article/K48866433?utm_source=f5support&%3Butm_medium=RSS support.f5.com
- https://usn.ubuntu.com/4239-1/ Third Party Advisory
- https://www.debian.org/security/2020/dsa-4626 Third Party Advisory
- https://www.debian.org/security/2020/dsa-4628 Third Party Advisory
- https://www.tenable.com/security/tns-2021-14 Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00036.html Third Party Advisory
- https://bugs.php.net/bug.php?id=78878 Mailing List, Patch, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2019/12/msg00034.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/ lists.fedoraproject.org
- https://seclists.org/bugtraq/2020/Feb/27 Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2020/Feb/31 Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2021/Jan/3 Mailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20200103-0002/ Third Party Advisory
- https://support.f5.com/csp/article/K48866433?utm_source=f5support&%3Butm_medium=RSS support.f5.com
- https://usn.ubuntu.com/4239-1/ Third Party Advisory
- https://www.debian.org/security/2020/dsa-4626 Third Party Advisory
- https://www.debian.org/security/2020/dsa-4628 Third Party Advisory
- https://www.tenable.com/security/tns-2021-14 Third Party Advisory