CVE-2019-11047
Heap-buffer-overflow READ in exif
En bref Sévérité MEDIUM 4.8 EPSS EPSS 7.47 % · centile 94 (2026-10-27) État PUBLISHED Publiée 2019-12-23 Mise à jour 2024-09-17 Attribuée par php Statut NVD Modified Description When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.
Scores Version Score Vecteur Évalué par CVSS 3.1 MEDIUM 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L php CVSS 3.1 MEDIUM 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L NVD · security@php.net (Secondary) CVSS 3.1 MEDIUM 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L NVD · nvd@nist.gov (Primary) CVSS 2.0 MEDIUM 6.4 AV:N/AC:L/Au:N/C:P/I:N/A:P NVD · nvd@nist.gov (Primary)
Faiblesses (CWE)
Références européennes
Avis du CERT-FR
Configurations affectées (CPE NVD) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 7.2.0 < 7.2.26cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 7.3.0 < 7.3.13cpe:2.3:a:php:php:7.4.0:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*Produits affectés Produit Versions PHP Group · PHP affected 7.2.x < 7.2.26 ; affected 7.3.x < 7.3.13 ; affected 7.4.x < 7.4.1
Références
Sources
