blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2019-11046

MEDIUM 5.3 CVSS 3.1
Published
December 23, 2019
Last modified
August 17, 2026
NVD status
Modified
Reported by
security@php.net
Weakness
CWE-125
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Description

In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, including Windows, can be tricked into reading beyond the allocated space by supplying it with string containing characters that are identified as numeric by the OS but aren't ASCII numbers. This can read to disclosure of the content of some memory locations.

Affected products and versions

  • PHP — From 7.2.0 (including) to 7.2.26 (including)
  • PHP — From 7.3.0 (including) to 7.3.13 (including)
  • PHP versions 7.4.0

References

  • lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00036.html Third Party Advisory
  • bugs.php.net https://bugs.php.net/bug.php?id=78878 Mailing List, Patch, Vendor Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2019/12/msg00034.html Mailing List, Third Party Advisory
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/
  • seclists.org https://seclists.org/bugtraq/2020/Feb/27 Mailing List, Third Party Advisory
  • seclists.org https://seclists.org/bugtraq/2020/Feb/31 Mailing List, Third Party Advisory
  • seclists.org https://seclists.org/bugtraq/2021/Jan/3 Mailing List, Third Party Advisory
  • security.netapp.com https://security.netapp.com/advisory/ntap-20200103-0002/ Third Party Advisory
  • support.f5.com https://support.f5.com/csp/article/K48866433?utm_source=f5support&amp%3Butm_medium=RSS
  • usn.ubuntu.com https://usn.ubuntu.com/4239-1/ Third Party Advisory
  • www.debian.org https://www.debian.org/security/2020/dsa-4626 Third Party Advisory
  • www.debian.org https://www.debian.org/security/2020/dsa-4628 Third Party Advisory
  • www.tenable.com https://www.tenable.com/security/tns-2021-14 Third Party Advisory
  • nvd.nist.gov Official NVD record