CVE-2019-11039 — Out-of-bounds Read in PHP

CWE-125 — Out-of-bounds ReadCWE-190 — Integer Overflow or Wraparound11 documents7 sources
Severity
9.1CRITICALNVD
EPSS
1.4%
top 19.45%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
PHPPhp5PHP Group PHP+3 more
Timeline
PublishedJun 19
Latest updateMay 24

Description

Function iconv_mime_decode_headers() in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 may perform out-of-buffer read due to integer overflow when parsing MIME headers. This may lead to information disclosure or crash.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HExploitability: 3.9 | Impact: 5.2

Affected Packages5 packages

▶NVDphp/php7.1.0 — 7.1.30+2
▶Ubuntuphp5/php5< 5.5.9+dfsg-1ubuntu4.29+esm3
▶CVEListV5php_group/php7.1.30, 7.2.19, 7.3.6+2
▶NVDopensuse/leap15.0, 15.1+1

Also affects: Debian Linux 10.0, 9.0

Patches

Patch: bugs.php.net ↗Patch: bugs.php.net ↗

🔴Vulnerability Details

5
GHSA
GHSA-fc8g-9mgh-947m: Function iconv_mime_decode_headers() in versions 7↗2022-05-24
▶
CVEList
Out-of-bounds read in iconv.c↗2019-06-18
▶
OSV
php5 vulnerabilities↗2019-06-05
▶
OSV
php7.0, php7.2 vulnerabilities↗2019-06-05
▶
OSV
CVE-2019-11039: Function iconv_mime_decode_headers() in PHP versions 7↗2019-06-03
▶

📋Vendor Advisories

3
Red Hat
php: Out-of-bounds read due to integer overflow in iconv_mime_decode_headers()↗2019-06-18
▶
Ubuntu
PHP vulnerabilities↗2019-06-05
▶
Ubuntu
PHP vulnerabilities↗2019-06-05
▶

💬Community

2
Bugzilla
CVE-2019-11038 CVE-2019-11039 CVE-2019-11040 php: various flaws [fedora-all]↗2019-06-26
▶
Bugzilla
CVE-2019-11039 php: Out-of-bounds read due to integer overflow in iconv_mime_decode_headers()↗2019-06-26
▶
CVE-2019-11039 — Out-of-bounds Read in PHP | cvebase