CVE-2019-11050 Information
Share on:Description
When PHP EXIF extension is parsing EXIF information from an image e.g. via exif_read_data() function in PHP versions 7.2.x below 7.2.26 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Reference
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00036.html https://bugs.php.net/bug.php?id=78793 https://lists.debian.org/debian-lts-announce/2019/12/msg00034.html https://lists.fedoraproject.org/archives/list/[email protected]/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/ https://lists.fedoraproject.org/archives/list/[email protected]/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/ https://seclists.org/bugtraq/2020/Feb/27 https://seclists.org/bugtraq/2020/Feb/31 https://security.netapp.com/advisory/ntap-20200103-0002/ https://usn.ubuntu.com/4239-1/ https://www.debian.org/security/2020/dsa-4626 https://www.debian.org/security/2020/dsa-4628
Attack Complexity
LOW
Privileges Required
NONE
User Interaction Required
NONE
Scope
NONE
Confidentiality Impact
UNCHANGED
Integrity Impact
LOW
Availability Impact
NONE
Base Score
LOW
Base Severity
6.5