NetSight
IP …
high7.5

CVE-2019-9022

An issue was discovered in PHP 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.2.

Impact

An issue was discovered in PHP 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.2. dns_get_record misparses a DNS response, which can allow a hostile DNS server to cause PHP to misuse memcpy, leading to read operations going past the buffer allocated for DNS data. This affects php_parserr in ext/standard/dns.c for DNS_CAA and DNS_ANY queries.

Affected products

VendorProductAffected versions
PhpPhp
from 7.0.0 before 7.1.26
from 7.2.0 before 7.2.14
from 7.3.0 before 7.3.2
DebianDebian Linux
Versions 8.0, 9.0
CanonicalUbuntu Linux
Versions 12.04, 14.04, 16.04
NetappStorage Automation Store
All versions

Weakness classification

CWE-125

References