CVE-2019-9639: High severity PHP PHP vulnerability
An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exifprocessIFDinMAKERNOTE because of mishandling the datalen variable.
Other sources
Fixed bug (Uninitialized read in exifprocessIFDinMAKERNOTE). (CVE-2019-9639)
— PHP
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-9639?
CVE-2019-9639 is a vulnerability in the EXIF component in PHP before versions 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3 that allows an uninitialized read in exif_process_IFD_in_MAKERNOTE due to mishandling the data_len variable.
How severe is CVE-2019-9639?
CVE-2019-9639 has a severity level of high with a CVSS score of 7.5.
Which software versions are affected by CVE-2019-9639?
CVE-2019-9639 affects PHP versions 7.1.27, 7.2.x up to 7.2.16, and 7.3.x up to 7.3.3.
How can I fix CVE-2019-9639?
To fix CVE-2019-9639, update PHP to version 7.1.27, 7.2.16, or 7.3.3 depending on your installed version.
Where can I find more information about CVE-2019-9639?
More information about CVE-2019-9639 can be found in the PHP ChangeLog (https://www.php.net/ChangeLog-7.php#7.1.27) and the PHP bug tracker (https://bugs.php.net/bug.php?id=77659).