CVE-2019-11042 — Out-of-bounds Read in Apple MAC OS X

CWE-125 — Out-of-bounds ReadCWE-120 — Classic Buffer Overflow14 documents9 sources
Severity
7.1HIGHNVD
EPSS
3.9%
top 11.74%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
9
Apple MAC OS XPHPTenable Tenable.sc+6 more
Timeline
PublishedAug 9
Latest updateMay 24

Description

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:HExploitability: 2.8 | Impact: 4.2

Affected Packages7 packages

▶NVDphp/php7.1.0 — 7.1.31+2
▶NVDapple/mac_os_x< 10.15.1
▶NVDtenable/tenable.sc< 5.19.0
▶Ubuntuphp5/php5< 5.5.9+dfsg-1ubuntu4.29+esm5
▶CVEListV5php_group/php7.1.x below 7.1.31, 7.2.x below 7.2.21, 7.3.x below 7.3.8+2

Also affects: Debian Linux 10.0, 8.0, 9.0, Ubuntu Linux 12.04, 14.04, 16.04, 18.04, 19.04

Patches

Patch: bugs.php.net ↗Patch: bugs.php.net ↗

🔴Vulnerability Details

5
GHSA
GHSA-pg67-q5vx-48xq: When PHP EXIF extension is parsing EXIF information from an image, e↗2022-05-24
▶
OSV
php5 vulnerabilities↗2019-08-13
▶
OSV
php7.0, php7.2 vulnerabilities↗2019-08-13
▶
CVEList
heap-buffer-overflow on exif_process_user_comment in EXIF extension↗2019-08-09
▶
OSV
CVE-2019-11042: When PHP EXIF extension is parsing EXIF information from an image, e↗2019-08-09
▶

📋Vendor Advisories

5
Apple
CVE-2019-11042: macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006↗2019-10-29
▶
Apple
CVE-2019-11042: macOS Catalina 10.15↗2019-10-07
▶
Ubuntu
PHP vulnerabilities↗2019-08-13
▶
Ubuntu
PHP vulnerabilities↗2019-08-13
▶
Red Hat
php: Heap buffer over-read in exif_process_user_comment()↗2019-08-09
▶

💬Community

3
HackerOne
Out of Bounds Memory Read in exif_process_user_comment↗2020-11-09
▶
Bugzilla
CVE-2019-11042 php: Heap buffer over-read in exif_process_user_comment()↗2019-08-09
▶
Bugzilla
CVE-2019-11042 php: heap buffer over-read in exif_process_user_comment() [fedora-all]↗2019-08-09
▶
CVE-2019-11042 — Out-of-bounds Read in Apple MAC OS X | cvebase