Out-of-bounds read in Fedoraproject products - CVE-2019-11047

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU33364

Out-of-bounds read in Fedoraproject products - CVE-2019-11047

Published: December 23, 2019 / Updated: August 4, 2020


Vulnerability identifier: #VU33364
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2019-11047
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vendor: PHP Group
Debian
Fedoraproject
Affected software:
PHP
Debian Linux
Fedora

Detailed vulnerability description

The vulnerability allows a remote non-authenticated attacker to #BASIC_IMPACT#.

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.


How to mitigate CVE-2019-11047

Install update from vendor's website.

Sources