CVE-2019-11040 Heap buffer overflow in EXIF extension
A heap buffer overflow in the PHP EXIF extension allows attackers to read past allocated buffers, potentially causing information disclosure or application crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-11040?
CVE-2019-11040 is a medium-severity vulnerability in Debian Debian Linux, published on 18 Jun 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.
Weakness: CWE-125
Which versions are affected by CVE-2019-11040?
It affects 4 products.
Products include Debian Debian Linux, Opensuse Leap, Php Php, Redhat Software Collections.
How do I fix CVE-2019-11040?
Upgrade to a fixed version.
Is CVE-2019-11040 being exploited?
There is no known exploitation of CVE-2019-11040 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as GHSA-9mjv-243x-3w2q, UBUNTU-CVE-2019-11040.