CVE-2019-11036

Sažetak

When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.29, 7.2.x below 7.2.18 and 7.3.x below 7.3.5 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash.

Reference

https://bugs.php.net/bug.php?id=77950
http://www.securityfocus.com/bid/108177
https://security.netapp.com/advisory/ntap-20190517-0003/
https://usn.ubuntu.com/3566-2/
https://lists.debian.org/debian-lts-announce/2019/05/msg00035.html
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00012.html
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00010.html
https://usn.ubuntu.com/4009-1/
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html
https://access.redhat.com/errata/RHSA-2019:2519
https://seclists.org/bugtraq/2019/Sep/35
https://www.debian.org/security/2019/dsa-4527
https://seclists.org/bugtraq/2019/Sep/38
https://www.debian.org/security/2019/dsa-4529
https://access.redhat.com/errata/RHSA-2019:3299
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3BY2XUUAN277LS7HKAOGL4DVGAELOJV3/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2NFXYNCXZCPYT7ZN4ZLI5EPQQW44FRRO/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WN2HLPGEZEF4MFM5YC5FILZB5QEQFP3A/

CVSS

Base:	6.4
Impact:	4.9
Exploitability:	10.0

Pristup

Vektor	Složenost	Autentikacija
NETWORK	LOW	NONE

Impact

Povjerljivost	Cjelovitost	Dostupnost
PARTIAL	NONE	PARTIAL

CVSS vektor

AV:N/AC:L/Au:N/C:P/I:N/A:P

Zadnje važnije ažuriranje

07-11-2023 - 03:02

Objavljeno

03-05-2019 - 20:29