CVE-2019-11046

תיאור (מקור, אנגלית)

In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, including Windows, can be tricked into reading beyond the allocated space by supplying it with string containing characters that are identified as numeric by the OS but aren't ASCII numbers. This can read to disclosure of the content of some memory locations.

מדדים

CVSS 3.1

5.3 (MEDIUM) מקור הציון: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS — סבירות ניצול

4% (אחוזון 100) נכון ל-19/8/2026

CWE

CWE-125

מוצרים מושפעים

php: php; debian: debian linux; fedoraproject: fedora; opensuse: leap; canonical: ubuntu linux; tenable: security center

קישורים

• https://bugs.php.net/bug.php?id=78878 Mailing ListPatchVendor Advisory
• https://bugs.php.net/bug.php?id=78878 Mailing ListPatchVendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00036.html Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/12/msg00034.html Mailing ListThird Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorap‮…
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorap‮…
• https://seclists.org/bugtraq/2020/Feb/27 Mailing ListThird Party Advisory
• https://seclists.org/bugtraq/2020/Feb/31 Mailing ListThird Party Advisory
• https://seclists.org/bugtraq/2021/Jan/3 Mailing ListThird Party Advisory
• https://security.netapp.com/advisory/ntap-20200103-0002/ Third Party Advisory