SB2019060312 - OpenSUSE Linux update for php7

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Out-of-bounds read (CVE-ID: CVE-2019-11034)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the exif_process_IFD_TAG() function in PHP EXIF extension when processing certain files. An attacker can pass a specially crafted file to the application,  trigger out-of-bounds read error and read contents of memory on the system or perform a denial of service attack.

2) Out-of-bounds read (CVE-ID: CVE-2019-11035)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the exif_iif_add_value() function in PHP EXIF extension when processing certain files. An attacker can pass a specially crafted file to the application,  trigger out-of-bounds read error and read contents of memory on the system or perform a denial of service attack.

3) Out-of-bounds read (CVE-ID: CVE-2019-11036)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in exif_process_IFD_TAG() function in PHP EXIF extension. A remote attacker can send a specially crafted file to the affected application, trigger out-of-bounds read error and read contents of memory on the system or crash the process.

Remediation

Install update from vendor's website.

References

• https://lists.opensuse.org/opensuse-security-announce/2019-06/msg00010.html