CVE-2019-11050

תיאור (מקור, אנגלית)

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.

מדדים

CVSS 3.1

6.5 (MEDIUM) מקור הציון: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

EPSS — סבירות ניצול

8% (אחוזון 100) נכון ל-19/8/2026

CWE

CWE-125

מוצרים מושפעים

php: php; canonical: ubuntu linux; debian: debian linux; fedoraproject: fedora; tenable: security center; opensuse: leap

קישורים

• https://bugs.php.net/bug.php?id=78793 ExploitMailing ListPatchVendor Advisory
• https://bugs.php.net/bug.php?id=78793 ExploitMailing ListPatchVendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00036.html Mailing ListThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/12/msg00034.html Mailing ListThird Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorap‮…
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorap‮…
• https://seclists.org/bugtraq/2020/Feb/27 Mailing ListThird Party Advisory
• https://seclists.org/bugtraq/2020/Feb/31 Mailing ListThird Party Advisory
• https://seclists.org/bugtraq/2021/Jan/3 Mailing ListThird Party Advisory
• https://security.netapp.com/advisory/ntap-20200103-0002/ Third Party Advisory