CVE-2019-9021: Buffer Overflow
An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A heap-based buffer over-read in PHAR reading functions in the PHAR extension may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse the file name, a different vulnerability than CVE-2018-20783. This is related to phardetectpharfnameext in ext/phar/phar.c.
Other sources
Fixed bug (heap buffer overflow in phardetectpharfnameext). (CVE-2019-9021)
— PHP
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rh-php71-phpto a version that resolves this vulnerability.Fixed in 0:7.1.30-1.el7 - Upgrade
Upgrade
redhat/rh-php72-phpto a version that resolves this vulnerability.Fixed in 0:7.2.24-1.el7 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 5.6.40 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.1.26 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.2.14 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.3.1 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 7.1.26 - Upgrade
Upgrade
alpine/php7to a version that resolves this vulnerability.Fixed in 7.2.14-r0 - Upgrade
Upgrade
alpine/php7to a version that resolves this vulnerability.Fixed in 7.2.17-r0 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 5.6.40 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 7.2.14 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 7.3.1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-9021?
CVE-2019-9021 is a vulnerability in PHP versions before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1 that allows an attacker to read allocated or unallocated memory through a heap-based buffer over-read in PHAR reading functions.
What is the severity of CVE-2019-9021?
The severity of CVE-2019-9021 is critical with a CVSS score of 9.8.
How does CVE-2019-9021 impact PHP?
CVE-2019-9021 can affect PHP versions before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1 by allowing an attacker to read memory beyond the intended data.
How can I fix CVE-2019-9021?
To fix CVE-2019-9021, you should update your PHP installation to version 5.6.40, 7.1.26, 7.2.14, or 7.3.1 or later, depending on the affected version.
Where can I find more information about CVE-2019-9021?
You can find more information about CVE-2019-9021 in the PHP ChangeLog and the Red Hat Security Advisory linked in the references.