CVE-2019-11041 heap-buffer-overflow on exif_scan_thumbnail in EXIF extension
A heap-buffer-overflow in the PHP EXIF extension allows attackers to cause information disclosure or application crashes via crafted image data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-11041?
CVE-2019-11041 is a medium-severity memory corruption vulnerability in Apple Mac Os X, published on 9 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.
Weakness: CWE-125
Which versions are affected by CVE-2019-11041?
It affects 7 products.
Products include Apple Mac Os X, Canonical Ubuntu Linux, Debian Debian Linux, Opensuse Leap, Php Php, Redhat Software Collections and 1 more.
How do I fix CVE-2019-11041?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2019-11041 being exploited?
There is no known exploitation of CVE-2019-11041 in the wild and no public exploit code.
Other vulnerabilities in Apple Mac Os X
Sources
Also known as GHSA-g668-x6wm-whp7, UBUNTU-CVE-2019-11041.