Read the docs
Red Hat Security Advisory

RHSA-2020:1624

php:7.2 security, bug fix, and enhancement update

Released 2020-04-28 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Fixes 17 records

TI-2019-08252 CVE-2019-11036 · GHSA-xr89-hqhp-26m9

Heap over-read in PHP EXIF extension

Priority MEDIUM 49

When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.29, 7.2.x below 7.2.18 and 7.3.x below 7.3.5 can be caused to read past allocated buffer in exif_process_IFD_TAG function.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.07031 Published 2019-05-03 Partial fix · 7.1.29, 7.2.18 +1 CWE-126
TI-2019-08256 CVE-2019-11040 · GHSA-9mjv-243x-3w2q

Heap buffer overflow in EXIF extension

Priority MEDIUM 46

When PHP EXIF extension is parsing EXIF information from an image, e.g.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.04068 Published 2019-06-18 Partial fix CWE-125
TI-2019-08251 CVE-2019-11035 · GHSA-82xj-4wm9-29x6

Heap over-read in PHP EXIF extension

Priority MEDIUM 46

When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_iif_add_value function.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.04409 Published 2019-04-18 Partial fix · 7.1.28, 7.2.17 +1 CWE-125
TI-2019-08250 CVE-2019-11034 · GHSA-x3rx-2m8v-q2vm

Heap over-read in PHP EXIF extension

Priority MEDIUM 46

When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_process_IFD_TAG function.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.04094 Published 2019-04-18 Partial fix · 7.1.28, 7.2.17 +1 CWE-125
TI-2019-08255 CVE-2019-11039 · GHSA-fc8g-9mgh-947m

Out-of-bounds read in iconv.c

Priority MEDIUM 45

Function iconv_mime_decode_headers() in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 may perform out-of-buffer read due to integer overflow when parsing MIME headers.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.0313 Published 2019-06-18 Partial fix CWE-125