CVE-2019-11040

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.

Link	Resource
https://bugs.php.net/bug.php?id=77988	Exploit Mailing List
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00029.html	Mailing List Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2519	Third Party Advisory
https://seclists.org/bugtraq/2019/Sep/35	Mailing List Third Party Advisory
https://www.debian.org/security/2019/dsa-4527	Third Party Advisory
https://seclists.org/bugtraq/2019/Sep/38	Mailing List Third Party Advisory
https://www.debian.org/security/2019/dsa-4529	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3299	Third Party Advisory

Configuration 1

cpe:2.3:a:php:php:*:*:*:*:*:*:*:* cpe:2.3:a:php:php:*:*:*:*:*:*:*:* cpe:2.3:a:php:php:*:*:*:*:*:*:*:* cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:* cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

---

Published : 2019-06-19 12:15

Updated : 2020-10-16 12:57

---

NVD link : CVE-2019-11040

Mitre link : CVE-2019-11040

No products.

CWE-125

Out-of-bounds Read