Out-of-bounds read in PHP - CVE-2019-9024

Vulnerability identifier: #VU22479

CSH Severity: Medium

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-9024

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the base64_decode_xmlrpc() function in ext/xmlrpc/libxmlrpc/base64.c when parsing untrusted input via the xmlrpc_decode() PHP function. A remote attacker can setup a malicious XMLRPC server, trick the application into connecting to it, trigger out-of-bounds read error and read contents of memory on the system.

PHP
Red Hat Software Collections
php (Red Hat package)
php7 (Alpine package)
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Opensuse
Flex System Chassis Management Module (CMM)

Install updates from vendor's website.

PHP - addressed in versions 5.6.40, 7.1.26, 7.2.14, 7.3.1
php (Red Hat package) - update to 5.4.16-48.el7
php7 (Alpine package) - update to 7.2.17-r0
Flex System Chassis Management Module (CMM) - update to 2pet18c-2.5.16c

• https://bugs.php.net/bug.php?id=77380

• Red Hat update for rh-php72-php
• Red Hat Enterprise Linux 7 update for php
• Red Hat Enterprise Linux 8 update for the php:7.2 module
• OpenSUSE Linux update for php5
• Out-of-bounds read in php7 (Alpine package)
• Multiple vulnerabilities in IBM Flex System Chassis Management Module (CMM)