CVE-2019-9024: High severity PHP PHP vulnerability

Q: What is CVE-2019-9024?

CVE-2019-9024 is a vulnerability in PHP versions before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1 that allows a hostile XMLRPC server to cause PHP to read memory outside of allocated areas.

Q: How severe is CVE-2019-9024?

CVE-2019-9024 has a severity value of 7.5, which is considered high.

Q: What is the affected software for CVE-2019-9024?

The affected software for CVE-2019-9024 includes PHP versions before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1.

Q: How can I fix CVE-2019-9024?

To fix CVE-2019-9024, update PHP to version 5.6.40 or higher for PHP 5.x, or update to the latest versions of PHP 7.1.x, 7.2.x, or 7.3.x.

Q: Where can I find more information about CVE-2019-9024?

You can find more information about CVE-2019-9024 in the PHP changelog and the Git commit logs.

Published Jan 10, 2019

Updated

An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. xmlrpcdecode() can allow a hostile XMLRPC server to cause PHP to read memory outside of allocated areas in base64decodexmlrpc in ext/xmlrpc/libxmlrpc/base64.c.

Other sources

Fixed bug (Global out of bounds read in xmlrpc base64 code). (CVE-2019-9024)

— PHP

Affected Software

25 affected componentsFixes available

redhat/php<0:5.4.16-48.el7

0:5.4.16-48.el7

redhat/rh-php71-php<0:7.1.30-1.el7

0:7.1.30-1.el7

redhat/rh-php72-php<0:7.2.24-1.el7

0:7.2.24-1.el7

debian/php5

debian/php7.0

debian/php7.3

PHP PHP<7.1.26

7.1.26

PHP PHP<5.6.40

PHP PHP>=7.0.0<7.1.26

PHP PHP>=7.2.0<7.2.14

PHP PHP>=7.3.0<7.3.1

Debian Debian Linux=9.0

Canonical Ubuntu Linux=12.04

Canonical Ubuntu Linux=14.04

Canonical Ubuntu Linux=16.04

NetApp Storage Automation Store

openSUSE Leap=42.3

alpine/php7<7.2.14-r0

7.2.14-r0

alpine/php7<7.2.14-r0

7.2.14-r0

alpine/php7<7.2.14-r0

7.2.14-r0

alpine/php7<7.2.14-r0

7.2.14-r0

alpine/php7<7.2.14-r0

7.2.14-r0

alpine/php7<7.2.14-r0

7.2.14-r0

alpine/php7<7.2.17-r0

7.2.17-r0

alpine/php7<7.2.14-r0

7.2.14-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/php to a version that resolves this vulnerability.
Fixed in 0:5.4.16-48.el7
Upgrade
Upgrade redhat/rh-php71-php to a version that resolves this vulnerability.
Fixed in 0:7.1.30-1.el7
Upgrade
Upgrade redhat/rh-php72-php to a version that resolves this vulnerability.
Fixed in 0:7.2.24-1.el7
Upgrade
Upgrade PHP to a version that resolves this vulnerability.
Fixed in 7.1.26
Upgrade
Upgrade alpine/php7 to a version that resolves this vulnerability.
Fixed in 7.2.14-r0
Upgrade
Upgrade alpine/php7 to a version that resolves this vulnerability.
Fixed in 7.2.17-r0
Upgrade
Upgrade PHP to a version that resolves this vulnerability.
Fixed in 5.6.40
Upgrade
Upgrade PHP to a version that resolves this vulnerability.
Fixed in 7.2.14
Upgrade
Upgrade PHP to a version that resolves this vulnerability.
Fixed in 7.3.1

Event History

Jan 10, 2019

CVE Published

via PHP·12:00 AM

Feb 22, 2019

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Data Sourced

via OSV·11:29 PM

DescriptionSeverityAffected Software

Mar 5, 2019

Data Sourced

via Red Hat·06:37 AM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is CVE-2019-9024?

CVE-2019-9024 is a vulnerability in PHP versions before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1 that allows a hostile XMLRPC server to cause PHP to read memory outside of allocated areas.

How severe is CVE-2019-9024?

CVE-2019-9024 has a severity value of 7.5, which is considered high.

What is the affected software for CVE-2019-9024?

The affected software for CVE-2019-9024 includes PHP versions before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1.

How can I fix CVE-2019-9024?

To fix CVE-2019-9024, update PHP to version 5.6.40 or higher for PHP 5.x, or update to the latest versions of PHP 7.1.x, 7.2.x, or 7.3.x.

Where can I find more information about CVE-2019-9024?

You can find more information about CVE-2019-9024 in the PHP changelog and the Git commit logs.

CVE-2019-9024: High severity PHP PHP vulnerability

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

What is CVE-2019-9024?

How severe is CVE-2019-9024?

What is the affected software for CVE-2019-9024?

How can I fix CVE-2019-9024?

Where can I find more information about CVE-2019-9024?

Company

Resources

Contact