CVE-2019-11042 Information
Share on:Description
When PHP EXIF extension is parsing EXIF information from an image e.g. via exif_read_data() function in PHP versions 7.1.x below 7.1.31 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Reference
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00019.html http://seclists.org/fulldisclosure/2019/Oct/15 http://seclists.org/fulldisclosure/2019/Oct/55 https://access.redhat.com/errata/RHSA-2019:3299 https://bugs.php.net/bug.php?id=78256 https://lists.debian.org/debian-lts-announce/2019/08/msg00010.html https://seclists.org/bugtraq/2019/Oct/9 https://seclists.org/bugtraq/2019/Sep/35 https://seclists.org/bugtraq/2019/Sep/38 https://security.netapp.com/advisory/ntap-20190822-0003/ https://support.apple.com/kb/HT210634 https://support.apple.com/kb/HT210722 https://usn.ubuntu.com/4097-1/ https://usn.ubuntu.com/4097-2/ https://www.debian.org/security/2019/dsa-4527 https://www.debian.org/security/2019/dsa-4529
Attack Complexity
LOW
Privileges Required
NONE
User Interaction Required
NONE
Scope
REQUIRED
Confidentiality Impact
UNCHANGED
Integrity Impact
LOW
Availability Impact
NONE
Base Score
HIGH
Base Severity
7.1