CVE-2019-9020: Use After Free
An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. Invalid input to the function xmlrpcdecode() can lead to an invalid memory access (heap out of bounds read or read after free). This is related to xmlelemparsebuf in ext/xmlrpc/libxmlrpc/xmlelement.c.
Other sources
Fixed bug (heap out of bounds read in xmlrpcdecode()). (CVE-2019-9020)
— PHP
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rh-php71-phpto a version that resolves this vulnerability.Fixed in 0:7.1.30-1.el7 - Upgrade
Upgrade
redhat/rh-php72-phpto a version that resolves this vulnerability.Fixed in 0:7.2.24-1.el7 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 5.6.40 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.1.26 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.2.14 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.3.1 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 7.1.26 - Upgrade
Upgrade
alpine/php7to a version that resolves this vulnerability.Fixed in 7.2.14-r0 - Upgrade
Upgrade
alpine/php7to a version that resolves this vulnerability.Fixed in 7.2.17-r0 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 5.6.40 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 7.2.14 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 7.3.1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2019-9020.
What is the severity of CVE-2019-9020?
The severity of CVE-2019-9020 is critical with a severity value of 9.8.
Which versions of PHP are affected by CVE-2019-9020?
PHP versions before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1 are affected.
What are the possible remedies for CVE-2019-9020?
The possible remedies for CVE-2019-9020 include updating PHP to version 5.6.40, 7.1.26, 7.2.14, or 7.3.1.
Where can I find more information about CVE-2019-9020?
You can find more information about CVE-2019-9020 in the following references: [Reference 1](https://www.php.net/ChangeLog-7.php#7.1.26), [Reference 2](https://bugs.php.net/bug.php?id=77242), [Reference 3](https://bugs.php.net/bug.php?id=77249).