CVE-2019-11040

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
PHP Group	PHP	7.1.30; 7.2.19; 7.3.6

References

http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00029.htmlMailing List, Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2519Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3299Third Party Advisory
https://bugs.php.net/bug.php?id=77988Exploit, Mailing List, Vendor Advisory
https://seclists.org/bugtraq/2019/Sep/35Mailing List, Third Party Advisory
https://seclists.org/bugtraq/2019/Sep/38Mailing List, Third Party Advisory
https://www.debian.org/security/2019/dsa-4527Third Party Advisory
https://www.debian.org/security/2019/dsa-4529Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00029.htmlMailing List, Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2519Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3299Third Party Advisory
https://bugs.php.net/bug.php?id=77988Exploit, Mailing List, Vendor Advisory
https://seclists.org/bugtraq/2019/Sep/35Mailing List, Third Party Advisory
https://seclists.org/bugtraq/2019/Sep/38Mailing List, Third Party Advisory
https://www.debian.org/security/2019/dsa-4527Third Party Advisory
https://www.debian.org/security/2019/dsa-4529Third Party Advisory

Timeline

Published: Jun 19, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-110417.1When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7 CVE-2019-110427.1When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7 CVE-2019-110439.8In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause CVE-2019-110447.5In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link() function accepts filenames with embedded \0 byte and CVE-2019-110455.9In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and tr CVE-2019-110465.3In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, including Windows, can be CVE-2019-110476.5When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7 CVE-2019-110485.3In PHP versions 7.2.x below 7.2.31, 7.3.x below 7.3.18 and 7.4.x below 7.4.6, when HTTP file uploads are allowed, supplying overly long file CVE-2019-110499.8In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to mail() function, due to mistake introduced in comm CVE-2019-11055.4A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages. An authenticat CVE-2019-110506.5When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7 CVE-2019-110578.8SQL injection vulnerability in Vtiger CRM before 7.1.0 hotfix3 allows authenticated users to execute arbitrary SQL commands.