SB2019122363 - Out-of-bounds read in PHP 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019122363

SB2019122363 - Out-of-bounds read in PHP

Published: December 23, 2019 Updated: August 4, 2020

Security Bulletin ID SB2019122363
Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Out-of-bounds read (CVE-ID: CVE-2019-11047)

The vulnerability allows a remote non-authenticated attacker to #BASIC_IMPACT#.

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.


Remediation

Install update from vendor's website.

References