CVE-2019-11036: Heap over-read in PHP EXIF extension
Fixed bug (Heap-buffer-overflow in estrndup via exifprocessIFDTAG) (CVE-2019-11036).
Other sources
When processing certain files, PHP EXIF extension in versions 7.1.x be ...
— Debian
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rh-php71-phpto a version that resolves this vulnerability.Fixed in 0:7.1.30-1.el7 - Upgrade
Upgrade
redhat/rh-php72-phpto a version that resolves this vulnerability.Fixed in 0:7.2.24-1.el7 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.1.29 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.2.18 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.3.5 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 7.1.29 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.1.29Patch CVE-2019-11036 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.2.18Patch CVE-2019-11036 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.3.5Patch CVE-2019-11036
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this bug?
The vulnerability ID for this bug is CVE-2019-11036.
What is the severity level of CVE-2019-11036?
The severity level of CVE-2019-11036 is medium.
What is the affected software for CVE-2019-11036?
The affected software for CVE-2019-11036 includes PHP versions 7.1.x below 7.1.29, 7.2.x below 7.2.18, and 7.3.x below 7.3.5.
How can CVE-2019-11036 be exploited?
CVE-2019-11036 can be exploited by processing certain files that can cause PHP EXIF extension to read past allocated buffer in the exif_process_IFD_TAG function, leading to information disclosure or crash.
Are there any remediation steps available for CVE-2019-11036?
Yes, remediation steps are available for CVE-2019-11036, and they involve updating PHP to versions 7.1.29, 7.2.18, or 7.3.5, or the corresponding packages from the Red Hat repository.