CVE-2019-11047: Heap-buffer-overflow READ in exif
A vulnerability was found in PHP EXIF extension is parsing EXIF information from an image, e.g. via exifreaddata() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.
Reference: https://bugs.php.net/bug.php?id=78910
Other sources
Fixed bug (Heap-buffer-overflow READ in exif). (CVE-2019-11047)
— PHP
When PHP EXIF extension is parsing EXIF information from an image, e.g. via exifreaddata() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rh-php73-phpto a version that resolves this vulnerability.Fixed in 0:7.3.20-1.el7 - Upgrade
Upgrade
redhat/php 7.2Git-2019-12to a version that resolves this vulnerability.Fixed in 04 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 7.2.26 - Upgrade
Upgrade
PHP EXIF extensionto a version that resolves this vulnerability.Fixed in 7.2.26 - Upgrade
Upgrade
PHP EXIF extensionto a version that resolves this vulnerability.Fixed in 7.3.13 - Upgrade
Upgrade
PHP EXIF extensionto a version that resolves this vulnerability.Fixed in 7.4.0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-11047?
CVE-2019-11047 is a fixed bug related to a heap-buffer-overflow read vulnerability in the PHP EXIF extension.
Is PHP version 7.4.0 affected by CVE-2019-11047?
Yes, PHP version 7.4.0 is affected by CVE-2019-11047.
How can I check if my PHP version is affected by CVE-2019-11047?
You can check if your PHP version is affected by CVE-2019-11047 by referring to the affected software list or by checking the PHP version against the known vulnerable versions (7.2.x below 7.2.26, 7.3.x below 7.3.13, and 7.4.0).
What is the severity of CVE-2019-11047?
CVE-2019-11047 has a severity rating of 6.5 (medium).
How do I fix the CVE-2019-11047 vulnerability?
To fix the CVE-2019-11047 vulnerability, you should update PHP to a patched version (7.2.26 or later, 7.3.13 or later, or 7.4.0 or later) or apply any available security patches provided by your operating system or software vendor.