CVE-2019-11035
Heap over-read in PHP EXIF extension
En bref Sévérité MEDIUM 4.8 EPSS EPSS 4.41 % · centile 91 (2026-10-27) État PUBLISHED Publiée 2019-04-18 Mise à jour 2024-09-17 Attribuée par php Statut NVD Modified Description When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_iif_add_value function. This may lead to information disclosure or crash.
Scores Version Score Vecteur Évalué par CVSS 3.0 MEDIUM 4.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L php CVSS 3.1 CRITICAL 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H NVD · nvd@nist.gov (Primary) CVSS 3.0 MEDIUM 4.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L NVD · security@php.net (Secondary) CVSS 2.0 MEDIUM 6.4 AV:N/AC:L/Au:N/C:P/I:N/A:P NVD · nvd@nist.gov (Primary)
Faiblesses (CWE)
Références européennes
Configurations affectées (CPE NVD) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 7.1.0 < 7.1.28cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 7.2.9 < 7.2.17cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 7.3.0 < 7.3.4cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*cpe:2.3:a:netapp:storage_automation_store:-:*:*:*:*:*:*:*cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*Produits affectés Produit Versions PHP Group · PHP affected 7.1.x < 7.1.28 ; affected 7.2.x < 7.2.17 ; affected 7.3.x < 7.3.4
Références
Sources
