Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
NVD Vulnerability Details :
CVE-2019-11036
Modified
More InfoOfficial Page
Source-security@php.net
View Known Exploited Vulnerability (KEV) details
Published At-03 May, 2019 | 20:29
Updated At-07 Nov, 2023 | 03:02

When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.29, 7.2.x below 7.2.18 and 7.3.x below 7.3.5 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Metrics
TypeVersionBase scoreBase severityVector
Primary3.19.1CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Secondary3.04.8MEDIUM
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Primary2.06.4MEDIUM
AV:N/AC:L/Au:N/C:P/I:N/A:P
CPE Matches
The PHP Group
php
>>php>>Versions from 7.1.0(inclusive) to 7.1.29(exclusive)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
The PHP Group
php
>>php>>Versions from 7.2.0(inclusive) to 7.2.18(exclusive)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
The PHP Group
php
>>php>>Versions from 7.3.0(inclusive) to 7.3.5(exclusive)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Fedora Project
fedoraproject
>>fedora>>28
cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:*
Fedora Project
fedoraproject
>>fedora>>29
cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
Fedora Project
fedoraproject
>>fedora>>30
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
Red Hat, Inc.
redhat
>>software_collections>>1.0
cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*
Canonical Ltd.
canonical
>>ubuntu_linux>>12.04
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
Canonical Ltd.
canonical
>>ubuntu_linux>>14.04
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
Canonical Ltd.
canonical
>>ubuntu_linux>>16.04
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
Canonical Ltd.
canonical
>>ubuntu_linux>>18.04
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
Canonical Ltd.
canonical
>>ubuntu_linux>>18.10
cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*
Canonical Ltd.
canonical
>>ubuntu_linux>>19.04
cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*
Debian GNU/Linux
debian
>>debian_linux>>8.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Debian GNU/Linux
debian
>>debian_linux>>9.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Debian GNU/Linux
debian
>>debian_linux>>10.0
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
openSUSE
opensuse
>>leap>>15.0
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
openSUSE
opensuse
>>leap>>15.1
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
openSUSE
opensuse
>>leap>>42.3
cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-125Primarynvd@nist.gov
CWE-126Secondarysecurity@php.net
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00010.htmlsecurity@php.net
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00012.htmlsecurity@php.net
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.htmlsecurity@php.net
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.htmlsecurity@php.net
Mailing List
Third Party Advisory
http://www.securityfocus.com/bid/108177security@php.net
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2019:2519security@php.net
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3299security@php.net
Third Party Advisory
https://bugs.php.net/bug.php?id=77950security@php.net
Mailing List
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2019/05/msg00035.htmlsecurity@php.net
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2NFXYNCXZCPYT7ZN4ZLI5EPQQW44FRRO/security@php.net
N/A
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3BY2XUUAN277LS7HKAOGL4DVGAELOJV3/security@php.net
N/A
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WN2HLPGEZEF4MFM5YC5FILZB5QEQFP3A/security@php.net
N/A
https://seclists.org/bugtraq/2019/Sep/35security@php.net
Mailing List
Third Party Advisory
https://seclists.org/bugtraq/2019/Sep/38security@php.net
Mailing List
Third Party Advisory
https://security.netapp.com/advisory/ntap-20190517-0003/security@php.net
Third Party Advisory
https://usn.ubuntu.com/3566-2/security@php.net
Third Party Advisory
https://usn.ubuntu.com/4009-1/security@php.net
Third Party Advisory
https://www.debian.org/security/2019/dsa-4527security@php.net
Third Party Advisory
https://www.debian.org/security/2019/dsa-4529security@php.net
Third Party Advisory
Change History
0Changes found
Details not found