vulnwire
4.8med

CVE-2019-11047

Heap-buffer-overflow READ in exif

Published 6 y ago · modified 4 mo ago · JSON

CVSS
4.8
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
7.5%
percentile 94%
Public exploits
0
none known

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.

Exploit prediction (EPSS)

7.47% probability of exploitation in the next 30 days, higher than 94% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA3.14.8CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
CNA3.14.8CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
NVD3.16.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
NVD2.06.4AV:N/AC:L/Au:N/C:P/I:N/A:P

Affected products

  • PHP Group PHP

Classification

Weakness
Technology feeds
PHP (RSS, critical only)

References

  • bugs.php.net /bug.php?id=78910 · x_refsource_MISC, x_transferred
  • lists.debian.org /debian-lts-announce/2019/12/msg00034.html · mailing-list, x_refsource_MLIST, x_transferred
  • security.netapp.com /advisory/ntap-20200103-0002/ · x_refsource_CONFIRM, x_transferred
  • lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGS · vendor-advisory, x_refsource_FEDORA, x_transferred
  • lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMK · vendor-advisory, x_refsource_FEDORA, x_transferred
  • usn.ubuntu.com /4239-1/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2020-01/msg00036.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • seclists.org /bugtraq/2020/Feb/27 · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • debian.org /security/2020/dsa-4626 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • debian.org /security/2020/dsa-4628 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • seclists.org /bugtraq/2020/Feb/31 · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • seclists.org /bugtraq/2021/Jan/3 · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • tenable.com /security/tns-2021-14 · x_refsource_CONFIRM, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.