CVE-2019-11040 Vulnerability Details

  /     /     /  

CVE-2019-11040 Metadata Quick Info

CVE Published: 18/06/2019 | CVE Updated: 16/09/2024 | CVE Year: 2019
Source: php | Vendor: PHP Group | Product: PHP
Status : PUBLISHED

---

CVE-2019-11040 Description

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-125
CWE Name: CWE-125 Out-of-bounds Read
Source: PHP Group

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).