CVE-2019-9021: Buffer Overflow
An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A heap-based buffer over-read in PHAR reading functions in the PHAR extension may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse the file name, a different vulnerability than CVE-2018-20783. This is related to phardetectpharfnameext in ext/phar/phar.c.
Other sources
Fixed bug (heap buffer overflow in phardetectpharfnameext). (CVE-2019-9021)
— PHP
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-9021?
CVE-2019-9021 is a vulnerability in PHP versions before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1 that allows an attacker to read allocated or unallocated memory through a heap-based buffer over-read in PHAR reading functions.
What is the severity of CVE-2019-9021?
The severity of CVE-2019-9021 is critical with a CVSS score of 9.8.
How does CVE-2019-9021 impact PHP?
CVE-2019-9021 can affect PHP versions before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1 by allowing an attacker to read memory beyond the intended data.
How can I fix CVE-2019-9021?
To fix CVE-2019-9021, you should update your PHP installation to version 5.6.40, 7.1.26, 7.2.14, or 7.3.1 or later, depending on the affected version.
Where can I find more information about CVE-2019-9021?
You can find more information about CVE-2019-9021 in the PHP ChangeLog and the Red Hat Security Advisory linked in the references.