CVE-2019-11046

MediumCVSS 5.3/10Last modified Aug 17, 2026

Description

In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, including Windows, can be tricked into reading beyond the allocated space by supplying it with string containing characters that are identified as numeric by the OS but aren't ASCII numbers. This can read to disclosure of the content of some memory locations.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-125

Affected software

VendorProductVersions
PHP GroupPHP>= 7.2.x, < 7.2.26; >= 7.3.x, < 7.3.13; >= 7.4.x, < 7.4.1

References

Timeline

Published
Dec 23, 2019
Last modified
Aug 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-110476.5When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7CVE-2019-110485.3In PHP versions 7.2.x below 7.2.31, 7.3.x below 7.3.18 and 7.4.x below 7.4.6, when HTTP file uploads are allowed, supplying overly long fileCVE-2019-110499.8In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to mail() function, due to mistake introduced in commCVE-2019-11055.4A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages. An authenticatCVE-2019-110506.5When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7CVE-2019-110578.8SQL injection vulnerability in Vtiger CRM before 7.1.0 hotfix3 allows authenticated users to execute arbitrary SQL commands.CVE-2019-110599.8Das U-Boot 2016.11-rc1 through 2019.04 mishandles the ext4 64-bit extension, resulting in a buffer overflow.CVE-2019-11067.5A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CCVE-2019-110607.5The web api server on Port 8080 of ASUS HG100 firmware up to 1.05.12, which is vulnerable to Slowloris HTTP Denial of Service: an attacker cCVE-2019-110618.1A broken access control vulnerability in HG100 firmware versions up to 4.00.06 allows an attacker in the same local area network to control CVE-2019-110629.8The SUNNET WMPro v5.0 and v5.1 for eLearning system has OS Command Injection via "/teach/course/doajaxfileupload.php". The target server canCVE-2019-110638.8A broken access control vulnerability in SmartHome app (Android versions up to 3.0.42_190515, ios versions up to 2.0.22) allows an attacker
CVE-2019-11046: Medium severity, CVSS 5.3 | Vulnix