CVE-2019-11047 Heap-buffer-overflow READ in exif
MediumCVSS 6.5
EPSS 7.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| PHP | >= 7.2.0, < 7.2.26 | 7.2.26 |
| PHP | >= 7.3.0, < 7.3.13 | 7.3.13 |
| PHP | = 7.4.0 | No fix listed |
| fedoraproject fedora | = 30 | No fix listed |
| fedoraproject fedora | = 31 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| debian linux | = 10.0 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| Canonical Ubuntu Linux | = 18.04 | No fix listed |
| Canonical Ubuntu Linux | = 19.04 | No fix listed |
| Canonical Ubuntu Linux | = 19.10 | No fix listed |
| alpine/php7(Alpine:v3.10) | < 7.3.13-r0 | 7.3.13-r0 |
| alpine/php7(Alpine:v3.11) | < 7.3.13-r0 | 7.3.13-r0 |
| alpine/php7(Alpine:v3.12) | < 7.3.13-r0 | 7.3.13-r0 |
| alpine/php7(Alpine:v3.13) | < 7.3.13-r0 | 7.3.13-r0 |
| alpine/php7(Alpine:v3.14) | < 7.3.13-r0 | 7.3.13-r0 |
| alpine/php7(Alpine:v3.15) | < 7.3.13-r0 | 7.3.13-r0 |
| alpine/php7(Alpine:v3.8) | < 7.2.26-r0 | 7.2.26-r0 |
| alpine/php7(Alpine:v3.9) | < 7.2.26-r0 | 7.2.26-r0 |
| PHP | >= 7.2.x, < 7.2.26 | 7.2.26 |
| PHP | >= 7.3.x, < 7.3.13 | 7.3.13 |
| PHP | >= 7.4.x, < 7.4.1 | 7.4.1 |
References
- openSUSE-SU-2020:0080 mailing-list third-party-advisory vendor-advisory
- bugs.php.net exploit patch vendor-advisory
- [debian-lts-announce] 20191229 [SECURITY] [DLA 2050-1] php5 security update mailing-list third-party-advisory
- FEDORA-2019-437d94e271 vendor-advisory
- FEDORA-2019-a54a622670 vendor-advisory
- 20200218 [SECURITY] [DSA 4626-1] php7.3 security update mailing-list third-party-advisory
- 20200219 [SECURITY] [DSA 4628-1] php7.0 security update mailing-list third-party-advisory
- 20210116 Re: [SECURITY] [DSA 4628-1] php7.0 security update mailing-list third-party-advisory
- security.netapp.com third-party-advisory
- USN-4239-1 third-party-advisory vendor-advisory
- DSA-4626 third-party-advisory vendor-advisory
- DSA-4628 third-party-advisory vendor-advisory
- www.tenable.com third-party-advisory
- security.alpinelinux.org vendor-advisory