PT-2019-4729 · Php+7 · Php+7
Nikita
·
Published
2019-12-21
·
Updated
2022-11-18
·
CVE-2019-11047
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
PHP versions 7.2.x through 7.2.25
PHP versions 7.3.x through 7.3.12
PHP version 7.4.0
Description
The issue is caused by a buffer overflow in the exif read data function of the PHP interpreter. This can allow a remote attacker to disclose protected information or cause a denial of service. The vulnerability is triggered when the PHP EXIF extension parses EXIF information from an image, such as through the
exif read data() function.Recommendations
For PHP version 7.2.x, update to version 7.2.26 or later.
For PHP version 7.3.x, update to version 7.3.13 or later.
For PHP version 7.4.0, update to a later version that includes the fix for this issue.
As a temporary workaround, consider disabling the
exif read data() function until a patch is available.Exploit
Fix
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Php
Red Hat
Rocky Linux
Suse
Ubuntu