CVE-2019-11042

CVE Details

Release Date:	2019-08-09
Impact:	None	What is this?

Description

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.

See more information about CVE-2019-11042 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	7.1
Vector String:	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Version:	3.0
Attack Vector:	Network
Attack Complexity:	Low
Privileges Required:	None
User Interaction:	Required
Scope:	Unchanged
Confidentiality Impact:	Low
Integrity Impact:	None
Availability Impact:	High

Errata information

Platform	Errata	Release Date
Oracle Linux version 8 (libzip)	ELSA-2020-1624	2020-05-05
Oracle Linux version 8 (libzip)	ELSA-2020-3662	2020-09-09
Oracle Linux version 8 (php)	ELSA-2020-1624	2020-05-05
Oracle Linux version 8 (php)	ELSA-2020-3662	2020-09-09
Oracle Linux version 8 (php-pear)	ELSA-2020-1624	2020-05-05
Oracle Linux version 8 (php-pear)	ELSA-2020-3662	2020-09-09
Oracle Linux version 8 (php-pecl-apcu)	ELSA-2020-1624	2020-05-05
Oracle Linux version 8 (php-pecl-apcu)	ELSA-2020-3662	2020-09-09
Oracle Linux version 8 (php-pecl-rrd)	ELSA-2020-3662	2020-09-09
Oracle Linux version 8 (php-pecl-xdebug)	ELSA-2020-3662	2020-09-09
Oracle Linux version 8 (php-pecl-zip)	ELSA-2020-1624	2020-05-05
Oracle Linux version 8 (php-pecl-zip)	ELSA-2020-3662	2020-09-09