Heap over-read in PHP EXIF extension
Priority MEDIUM 49CWE-126Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · High
- Fix status
- Partial Red Hat: 7 fixed, 4 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.
Summary
When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.29, 7.2.x below 7.2.18 and 7.3.x below 7.3.5 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash.
Why it matters now
EPSS 0.07031 94th percentileScored 2026-11-07
Fix Partial PHP (PHP Group): 7.1.29, 7.2.18, 7.3.5Red Hat: 3 advisoriesRed Hat: 7 fixed, 4 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| PHP Group | PHP | 7.1.x to before 7.1.29; 7.2.x to before 7.2.18; 7.3.x to before 7.3.5 | 7.1.29, 7.2.18, 7.3.5 | Patch available | CNA |
- PHP VendorPHP Group Affected 7.1.x to before 7.1.29; 7.2.x to before 7.2.18; 7.3.x to before 7.3.5 Fixed in 7.1.29, 7.2.18, 7.3.5 Patch available CNA
CPE configurations NVD · 17
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:php:php:*:*:*:*:*:*:*:* | 7.1.0 to before 7.1.29; 7.2.0 to before 7.2.18; 7.3.0 to before 7.3.5 | Vulnerable | PHP |
| cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:* | 28 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* | 29 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* | 30 | Vulnerable | Fedoraproject |
| cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:* | 1.0 | Vulnerable | Red Hat |
| cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:* | 12.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* | 14.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* | 16.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | 18.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:* | 18.10 | Vulnerable | Canonical |
- cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Versions 7.1.0 to before 7.1.29; 7.2.0 to before 7.2.18; 7.3.0 to before 7.3.5 Vulnerable ·PHP
- cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:* Versions 28 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* Versions 29 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
- cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Red Hat
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:* Versions 12.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* Versions 14.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:* Versions 18.10 Vulnerable ·Canonical
Show 7 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* | 19.04 | Vulnerable | Canonical |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* | 15.0 | Vulnerable | openSUSE |
| cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* | 15.1 | Vulnerable | openSUSE |
| cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:* | 42.3 | Vulnerable | openSUSE |
- cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* Versions 19.04 Vulnerable ·Canonical
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·openSUSE
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
- cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:* Versions 42.3 Vulnerable ·openSUSE
Remediation
- Fix · CNA PHP (PHP Group) Fixed in 7.1.29, 7.2.18, 7.3.5
Red Hat 3 advisories
- RHSA-2020:1624 Released 2020-04-28 · Red Hat rating Moderatephp:7.2 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) apcu-panel-5.1.12-2.module+el8.1.0+3202+af5476b9.noarch::php:7.2, libzip-1.5.1-2.module+el8.1.0+3202+af5476b9.aarch64::php:7.2, libzip-1.5.1-2.module+el8.1.0+3202+af5476b9.ppc64le::php:7.2 +47
- RHSA-2019:3299 Released 2019-11-01 · Red Hat rating Criticalrh-php72-php security update
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-php72-php-7.2.24-1.el7, rh-php72-php-bcmath-7.2.24-1.el7, rh-php72-php-cli-7.2.24-1.el7 +26
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-php72-php-7.2.24-1.el7, rh-php72-php-bcmath-7.2.24-1.el7, rh-php72-php-cli-7.2.24-1.el7 +26
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-php72-php-7.2.24-1.el7, rh-php72-php-bcmath-7.2.24-1.el7, rh-php72-php-cli-7.2.24-1.el7 +26
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-php72-php-7.2.24-1.el7, rh-php72-php-bcmath-7.2.24-1.el7, rh-php72-php-cli-7.2.24-1.el7 +26
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-php72-php-7.2.24-1.el7, rh-php72-php-bcmath-7.2.24-1.el7, rh-php72-php-cli-7.2.24-1.el7 +26
- RHSA-2019:2519 Released 2019-08-19 · Red Hat rating Moderaterh-php71-php security, bug fix, and enhancement update
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-php71-php-7.1.30-1.el7, rh-php71-php-bcmath-7.1.30-1.el7, rh-php71-php-cli-7.1.30-1.el7 +26
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-php71-php-7.1.30-1.el7, rh-php71-php-bcmath-7.1.30-1.el7, rh-php71-php-cli-7.1.30-1.el7 +26
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-php71-php-7.1.30-1.el7, rh-php71-php-bcmath-7.1.30-1.el7, rh-php71-php-cli-7.1.30-1.el7 +26
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-php71-php-7.1.30-1.el7, rh-php71-php-bcmath-7.1.30-1.el7, rh-php71-php-cli-7.1.30-1.el7 +26
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-php71-php-7.1.30-1.el7, rh-php71-php-bcmath-7.1.30-1.el7, rh-php71-php-cli-7.1.30-1.el7 +26
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 5 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Software Collections | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2020:1624 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2019:2519, RHSA-2019:3299 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) | Fixed | RHSA-2019:2519 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) | Fixed | RHSA-2019:2519, RHSA-2019:3299 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) | Fixed | RHSA-2019:2519, RHSA-2019:3299 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) | Fixed | RHSA-2019:3299 |
| Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2019:2519, RHSA-2019:3299 |
Timeline
- 2026-10-02 Threatist record created from CVE-2019-11036
- 2026-10-03 Alias added: GHSA-xr89-hqhp-26m9
References
Advisory 18
- https://bugs.php.net/bug.php?id=77950
- FEDORA-2019-6350c4e21a
- FEDORA-2019-6e325234a4
- FEDORA-2019-bab3944fee
- https://security.netapp.com/advisory/ntap-20190517-0003/
- USN-3566-2
- [debian-lts-announce] 20190525 [SECURITY] [DLA 1803-1] php5 security update
- openSUSE-SU-2019:1501
- openSUSE-SU-2019:1503
- USN-4009-1
- openSUSE-SU-2019:1572
- openSUSE-SU-2019:1573
- RHSA-2019:2519
- 20190920 [SECURITY] [DSA 4527-1] php7.3 security update
- DSA-4527
- DSA-4529
- 20190923 [SECURITY] [DSA 4529-1] php7.0 security update
- RHSA-2019:3299
More PHP Group vulnerabilities
- TI-2024-04260 Argument Injection in PHP-CGI KEVCVSS 3.1CRITICAL 9.8
- TI-2026-78794 PHP remote code execution via stale global state KEVCVSS 4.0CRITICAL 9.2
- TI-2026-78793 Out-of-memory handling flaw in PHP allows remote code execution KEVCVSS 4.0CRITICAL 9.2
- TI-2024-01743 Command injection via array-ish $command parameter of proc_open() CVSS 3.1CRITICAL 9.4
- TI-2022-13555 PDO::quote() may return unquoted string CVSS 3.1CRITICAL 9.1
- TI-2024-10408 Reference counting in php_request_shutdown causes Use-After-Free CVSS 4.0CRITICAL 9.2
Sources
- CVE-2019-11036 · CVE Program
- CVE-2019-11036 · NVD
- FIRST EPSS
- GHSA-xr89-hqhp-26m9 · GitHub Advisory Database · CC BY 4.0
- CVE-2019-11036 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences