CVE-2019-11035: Heap over-read in PHP EXIF extension
Fixed bug (Heap-buffer-overflow in exifiifaddvalue). (CVE-2019-11035)
Other sources
When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exifiifaddvalue function. This may lead to information disclosure or crash.
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-11035?
CVE-2019-11035 is a vulnerability in the PHP EXIF extension that can lead to information disclosure or crash.
How does CVE-2019-11035 affect PHP?
CVE-2019-11035 affects PHP versions 7.1.x below 7.1.28, 7.2.x below 7.2.17, and 7.3.x below 7.3.4.
What is the severity of CVE-2019-11035?
CVE-2019-11035 has a severity rating of 6.5 (medium).
How can CVE-2019-11035 be exploited?
CVE-2019-11035 can be exploited by processing certain files that cause PHP to read past allocated buffer in the exif_iif_add_value function.
How can I fix CVE-2019-11035?
To fix CVE-2019-11035, upgrade PHP to version 7.1.28 or later for PHP 7.1.x, 7.2.17 or later for PHP 7.2.x, or 7.3.4 or later for PHP 7.3.x.