CVE-2019-9639: High severity PHP PHP vulnerability
An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exifprocessIFDinMAKERNOTE because of mishandling the datalen variable.
Other sources
Fixed bug (Uninitialized read in exifprocessIFDinMAKERNOTE). (CVE-2019-9639)
— PHP
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rh-php71-phpto a version that resolves this vulnerability.Fixed in 0:7.1.30-1.el7 - Upgrade
Upgrade
redhat/rh-php72-phpto a version that resolves this vulnerability.Fixed in 0:7.2.24-1.el7 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.1.27 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.2.16 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.3.3 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 7.1.27 - Upgrade
Upgrade
alpine/php7to a version that resolves this vulnerability.Fixed in 7.2.16-r0 - Upgrade
Upgrade
alpine/php7to a version that resolves this vulnerability.Fixed in 7.1.29-r0 - Upgrade
Upgrade
alpine/php7to a version that resolves this vulnerability.Fixed in 7.2.17-r0 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 7.2.16 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 7.3.3
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-9639?
CVE-2019-9639 is a vulnerability in the EXIF component in PHP before versions 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3 that allows an uninitialized read in exif_process_IFD_in_MAKERNOTE due to mishandling the data_len variable.
How severe is CVE-2019-9639?
CVE-2019-9639 has a severity level of high with a CVSS score of 7.5.
Which software versions are affected by CVE-2019-9639?
CVE-2019-9639 affects PHP versions 7.1.27, 7.2.x up to 7.2.16, and 7.3.x up to 7.3.3.
How can I fix CVE-2019-9639?
To fix CVE-2019-9639, update PHP to version 7.1.27, 7.2.16, or 7.3.3 depending on your installed version.
Where can I find more information about CVE-2019-9639?
More information about CVE-2019-9639 can be found in the PHP ChangeLog (https://www.php.net/ChangeLog-7.php#7.1.27) and the PHP bug tracker (https://bugs.php.net/bug.php?id=77659).