CVE-2019-11041

Published Aug 9, 2019

Last updated 2 years ago

Overview

Description
When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.
Source
security@php.net
NVD status
Analyzed

Risk scores

CVSS 3.1

Type
Primary
Base score
7.1
Impact score
4.2
Exploitability score
2.8
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Severity
HIGH

CVSS 3.0

Type
Secondary
Base score
4.8
Impact score
2.5
Exploitability score
2.2
Vector string
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Severity
MEDIUM

CVSS 2.0

Type
Primary
Base score
5.8
Impact score
4.9
Exploitability score
8.6
Vector string
AV:N/AC:M/Au:N/C:P/I:N/A:P

Weaknesses

nvd@nist.gov
CWE-125
security@php.net
CWE-125

Social media

Hype score
Not currently trending

Configurations