CVE-2019-9022: Buffer Overflow
An issue was discovered in PHP 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.2. dnsgetrecord misparses a DNS response, which can allow a hostile DNS server to cause PHP to misuse memcpy, leading to read operations going past the buffer allocated for DNS data. This affects phpparserr in ext/standard/dns.c for DNSCAA and DNSANY queries.
Other sources
Fixed bug (memcpy with negative length via crafted DNS response). (CVE-2019-9022)
— PHP
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2019-9022.
What is the severity of CVE-2019-9022?
The severity of CVE-2019-9022 is high, with a severity value of 7.5.
Which software versions are affected by CVE-2019-9022?
PHP versions before 7.1.26, 7.2.14, and 7.3.2 are affected.
How does CVE-2019-9022 impact PHP?
CVE-2019-9022 allows a hostile DNS server to cause PHP to misuse memcpy, leading to read operations going past the buffer allocated for DNS data.
Are there any solutions or fixes available for CVE-2019-9022?
Yes, updating PHP to version 7.1.26, 7.2.14, or 7.3.2 will fix the vulnerability.