CVE-2019-11047

Published: Dec 23, 2019Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Exploitability: 3.9 / Impact: 2.5

Source: NVD

Description

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.

Affected (14)

Products: Php: Php · Fedoraproject: Fedora · Debian: Debian Linux · +1 more

Show all products

Php: Php · Fedoraproject: Fedora · Debian: Debian Linux · Canonical: Ubuntu Linux

1 product

1 product

1 product

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Php Php	From 7.2.0 to 7.2.26
Php Php	From 7.3.0 to 7.3.13
Php Php	Version 7.4.0

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 30
Fedoraproject Fedora	Version 31

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 8.0
Debian Debian Linux	Version 9.0

Configuration D

6 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 18.04
Canonical Ubuntu Linux	Version 19.04
Canonical Ubuntu Linux	Version 19.10

Related CWEs

Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

References (26)

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00036.html

Source: security@php.net

Mailing ListThird Party Advisory

https://bugs.php.net/bug.php?id=78910

Source: security@php.net

ExploitPatchVendor Advisory

https://lists.debian.org/debian-lts-announce/2019/12/msg00034.html

Source: security@php.net

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/

Source: security@php.net

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/

Source: security@php.net

https://seclists.org/bugtraq/2020/Feb/27

Source: security@php.net

Mailing ListThird Party Advisory

https://seclists.org/bugtraq/2020/Feb/31

Source: security@php.net

Mailing ListThird Party Advisory

https://seclists.org/bugtraq/2021/Jan/3

Source: security@php.net

Mailing ListThird Party Advisory

https://security.netapp.com/advisory/ntap-20200103-0002/

Source: security@php.net

Third Party Advisory

https://usn.ubuntu.com/4239-1/

Source: security@php.net

Third Party Advisory

https://www.debian.org/security/2020/dsa-4626

Source: security@php.net

Third Party Advisory

https://www.debian.org/security/2020/dsa-4628

Source: security@php.net

Third Party Advisory

https://www.tenable.com/security/tns-2021-14

Source: security@php.net

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00036.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://bugs.php.net/bug.php?id=78910

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatchVendor Advisory

https://lists.debian.org/debian-lts-announce/2019/12/msg00034.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/

Source: af854a3a-2127-422b-91ae-364da2661108

https://seclists.org/bugtraq/2020/Feb/27

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://seclists.org/bugtraq/2020/Feb/31

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://seclists.org/bugtraq/2021/Jan/3

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://security.netapp.com/advisory/ntap-20200103-0002/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://usn.ubuntu.com/4239-1/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.debian.org/security/2020/dsa-4626

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.debian.org/security/2020/dsa-4628

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.tenable.com/security/tns-2021-14

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.