CVE-2019-11050

Published: Dec 23, 2019Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Exploitability: 3.9 / Impact: 2.5

Source: NVD

Description

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.

Affected (15)

Products: Php: Php · Canonical: Ubuntu Linux · Debian: Debian Linux · +3 more

Show all products

Php: Php · Canonical: Ubuntu Linux · Debian: Debian Linux · Fedoraproject: Fedora · Opensuse: Leap · Tenable: Securitycenter

1 product

1 product

1 product

1 product

1 product

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Php Php	From 7.2.0 to 7.2.26
Php Php	From 7.3.0 to 7.3.13
Php Php	Version 7.4.0

Configuration B

8 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 18.04
Canonical Ubuntu Linux	Version 19.04
Debian Debian Linux	Version 8.0
Fedoraproject Fedora	Version 30
Fedoraproject Fedora	Version 31

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 9.0

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 15.1
Tenable Securitycenter	Before 5.19.0

Related CWEs

Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

References (26)

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00036.html

Source: security@php.net

Mailing ListThird Party Advisory

https://bugs.php.net/bug.php?id=78793

Source: security@php.net

ExploitMailing ListPatchVendor Advisory

https://lists.debian.org/debian-lts-announce/2019/12/msg00034.html

Source: security@php.net

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/

Source: security@php.net

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/

Source: security@php.net

https://seclists.org/bugtraq/2020/Feb/27

Source: security@php.net

Mailing ListThird Party Advisory

https://seclists.org/bugtraq/2020/Feb/31

Source: security@php.net

Mailing ListThird Party Advisory

https://seclists.org/bugtraq/2021/Jan/3

Source: security@php.net

Mailing ListThird Party Advisory

https://security.netapp.com/advisory/ntap-20200103-0002/

Source: security@php.net

Third Party Advisory

https://usn.ubuntu.com/4239-1/

Source: security@php.net

Third Party Advisory

https://www.debian.org/security/2020/dsa-4626

Source: security@php.net

Third Party Advisory

https://www.debian.org/security/2020/dsa-4628

Source: security@php.net

Third Party Advisory

https://www.tenable.com/security/tns-2021-14

Source: security@php.net

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00036.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://bugs.php.net/bug.php?id=78793

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitMailing ListPatchVendor Advisory

https://lists.debian.org/debian-lts-announce/2019/12/msg00034.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/

Source: af854a3a-2127-422b-91ae-364da2661108

https://seclists.org/bugtraq/2020/Feb/27

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://seclists.org/bugtraq/2020/Feb/31

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://seclists.org/bugtraq/2021/Jan/3

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://security.netapp.com/advisory/ntap-20200103-0002/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://usn.ubuntu.com/4239-1/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.debian.org/security/2020/dsa-4626

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.debian.org/security/2020/dsa-4628

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.tenable.com/security/tns-2021-14

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.