CVE-2019-9022: Buffer Overflow
An issue was discovered in PHP 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.2. dnsgetrecord misparses a DNS response, which can allow a hostile DNS server to cause PHP to misuse memcpy, leading to read operations going past the buffer allocated for DNS data. This affects phpparserr in ext/standard/dns.c for DNSCAA and DNSANY queries.
Other sources
Fixed bug (memcpy with negative length via crafted DNS response). (CVE-2019-9022)
— PHP
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rh-php71-phpto a version that resolves this vulnerability.Fixed in 0:7.1.30-1.el7 - Upgrade
Upgrade
redhat/rh-php72-phpto a version that resolves this vulnerability.Fixed in 0:7.2.24-1.el7 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.1.26 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.2.14 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.3.1 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 7.1.26 - Upgrade
Upgrade
alpine/php7to a version that resolves this vulnerability.Fixed in 7.2.14-r0 - Upgrade
Upgrade
alpine/php7to a version that resolves this vulnerability.Fixed in 7.2.17-r0 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 7.2.14 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 7.3.2
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2019-9022.
What is the severity of CVE-2019-9022?
The severity of CVE-2019-9022 is high, with a severity value of 7.5.
Which software versions are affected by CVE-2019-9022?
PHP versions before 7.1.26, 7.2.14, and 7.3.2 are affected.
How does CVE-2019-9022 impact PHP?
CVE-2019-9022 allows a hostile DNS server to cause PHP to misuse memcpy, leading to read operations going past the buffer allocated for DNS data.
Are there any solutions or fixes available for CVE-2019-9022?
Yes, updating PHP to version 7.1.26, 7.2.14, or 7.3.2 will fix the vulnerability.