PT-2019-1895 · Php+7 · Php+7
H4X0N4Ut
·
Publicado
2019-01-17
·
Atualizado
2024-06-15
·
CVE-2019-9022
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
PHP versions 7.0.x through 7.1.25
PHP versions 7.2.x through 7.2.13
PHP versions 7.3.x through 7.3.1
Description
An issue in PHP's dns get record function can cause it to misparse a DNS response, allowing a hostile DNS server to cause PHP to misuse memcpy, leading to read operations going past the buffer allocated for DNS data. This affects php parserr in ext/standard/dns.c for DNS CAA and DNS ANY queries. The vulnerability is related to a buffer overflow in the PHAR dns get record function, which can allow a remote attacker to access confidential data when processing DNS responses.
Recommendations
For PHP versions 7.0.x through 7.1.25, update to version 7.1.26 or later.
For PHP versions 7.2.x through 7.2.13, update to version 7.2.14 or later.
For PHP versions 7.3.x through 7.3.1, update to version 7.3.2 or later.
Exploit
Correção
Out of bounds Read
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Almalinux
Centos
Php
Red Hat
Rocky Linux
Suse
Ubuntu