blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2019-11041

HIGH 7.1 CVSS 3.1
Published
August 9, 2019
Last modified
June 17, 2026
NVD status
Modified
Reported by
security@php.net
Weakness
CWE-125
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Description

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.

Affected products and versions

  • PHP — From 7.1.0 (including) to 7.1.31 (excluding)
  • PHP — From 7.2.0 (including) to 7.2.21 (excluding)
  • PHP — From 7.3.0 (including) to 7.3.8 (excluding)

References

  • lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00019.html Third Party Advisory
  • seclists.org http://seclists.org/fulldisclosure/2019/Oct/15 Mailing List, Third Party Advisory
  • seclists.org http://seclists.org/fulldisclosure/2019/Oct/55 Mailing List, Third Party Advisory
  • access.redhat.com https://access.redhat.com/errata/RHSA-2019:3299 Third Party Advisory
  • bugs.php.net https://bugs.php.net/bug.php?id=78222 Exploit, Patch, Vendor Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2019/08/msg00010.html Mailing List, Third Party Advisory
  • seclists.org https://seclists.org/bugtraq/2019/Oct/9 Mailing List, Third Party Advisory
  • seclists.org https://seclists.org/bugtraq/2019/Sep/35 Mailing List, Third Party Advisory
  • seclists.org https://seclists.org/bugtraq/2019/Sep/38 Mailing List, Third Party Advisory
  • security.netapp.com https://security.netapp.com/advisory/ntap-20190822-0003/ Third Party Advisory
  • support.apple.com https://support.apple.com/kb/HT210634 Third Party Advisory
  • support.apple.com https://support.apple.com/kb/HT210722 Third Party Advisory
  • usn.ubuntu.com https://usn.ubuntu.com/4097-1/ Third Party Advisory
  • usn.ubuntu.com https://usn.ubuntu.com/4097-2/ Third Party Advisory
  • www.debian.org https://www.debian.org/security/2019/dsa-4527 Third Party Advisory
  • www.debian.org https://www.debian.org/security/2019/dsa-4529 Third Party Advisory
  • www.tenable.com https://www.tenable.com/security/tns-2021-14 Third Party Advisory
  • nvd.nist.gov Official NVD record