NetSight
IP …
critical9.1

CVE-2019-11035

When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated…

Impact

When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_iif_add_value function. This may lead to information disclosure or crash.

Affected products

VendorProductAffected versions
PhpPhp
from 7.1.0 before 7.1.28
from 7.2.9 before 7.2.17
from 7.3.0 before 7.3.4
CanonicalUbuntu Linux
Versions 12.04, 14.04, 16.04, 18.04, 18.10, 19.04
NetappStorage Automation Store
All versions
RedhatSoftware Collections
Version 1.0
OpensuseLeap
Versions 15.0, 15.1, 42.3
DebianDebian Linux
Versions 8.0, 9.0

Weakness classification

CWE-125

References