CVE-2019-9024: High severity PHP PHP vulnerability
An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. xmlrpcdecode() can allow a hostile XMLRPC server to cause PHP to read memory outside of allocated areas in base64decodexmlrpc in ext/xmlrpc/libxmlrpc/base64.c.
Other sources
Fixed bug (Global out of bounds read in xmlrpc base64 code). (CVE-2019-9024)
— PHP
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-9024?
CVE-2019-9024 is a vulnerability in PHP versions before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1 that allows a hostile XMLRPC server to cause PHP to read memory outside of allocated areas.
How severe is CVE-2019-9024?
CVE-2019-9024 has a severity value of 7.5, which is considered high.
What is the affected software for CVE-2019-9024?
The affected software for CVE-2019-9024 includes PHP versions before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1.
How can I fix CVE-2019-9024?
To fix CVE-2019-9024, update PHP to version 5.6.40 or higher for PHP 5.x, or update to the latest versions of PHP 7.1.x, 7.2.x, or 7.3.x.
Where can I find more information about CVE-2019-9024?
You can find more information about CVE-2019-9024 in the PHP changelog and the Git commit logs.