CVE-2019-11050: Use-after-free in exif parsing under memory sanitizer
Fixed bug (Use-after-free in exif parsing under memory sanitizer). (CVE-2019-11050)
Other sources
When PHP EXIF extension is parsing EXIF information from an image, e.g. via exifreaddata() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-11050?
CVE-2019-11050 is a vulnerability in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13, and 7.4.0 that allows an attacker to read past the allocated buffer, potentially leading to information disclosure.
How severe is CVE-2019-11050?
CVE-2019-11050 has a severity rating of 6.5.
Which software versions are affected by CVE-2019-11050?
PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13, and 7.4.0 are affected by CVE-2019-11050.
How can I fix CVE-2019-11050?
To fix CVE-2019-11050, upgrade PHP to version 7.2.26, 7.3.13, or 7.4.1 depending on the version you are using.
Where can I find more information about CVE-2019-11050?
You can find more information about CVE-2019-11050 on the following references: [1] [2] [3]