CVE-2019-11039

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (7.2.24). (BZ#1726981)

Security Fix(es):

• php: Invalid memory access in function xmlrpc_decode() (CVE-2019-9020)

• php: File rename across filesystems may allow unwanted access during processing (CVE-2019-9637)

• php: Uninitialized read in exif_process_IFD_in_MAKERNOTE (CVE-2019-9638)

• php: Uninitialized read in exif_process_IFD_in_MAKERNOTE (CVE-2019-9639)

• php: Invalid read in exif_process_SOFn() (CVE-2019-9640)

• php: Out-of-bounds read due to integer overflow in iconv_mime_decode_headers() (CVE-2019-11039)

• php: Buffer over-read in exif_read_data() (CVE-2019-11040)

• php: Buffer over-read in PHAR reading functions (CVE-2018-20783)

• php: Heap-based buffer over-read in PHAR reading functions (CVE-2019-9021)

• php: memcpy with negative length via crafted DNS response (CVE-2019-9022)

• php: Heap-based buffer over-read in mbstring regular expression functions (CVE-2019-9023)

• php: Out-of-bounds read in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c (CVE-2019-9024)

• php: Heap buffer overflow in function exif_process_IFD_TAG() (CVE-2019-11034)

• php: Heap buffer overflow in function exif_iif_add_value() (CVE-2019-11035)

• php: Buffer over-read in exif_process_IFD_TAG() leading to information disclosure (CVE-2019-11036)

• php: Heap buffer over-read in exif_scan_thumbnail() (CVE-2019-11041)

• php: Heap buffer over-read in exif_process_user_comment() (CVE-2019-11042)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.2 Release Notes linked from the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (7.3.20). (BZ#1856655)

Security Fix(es):

• php: Out-of-bounds read due to integer overflow in iconv_mime_decode_headers() (CVE-2019-11039)

• php: Buffer over-read in exif_read_data() (CVE-2019-11040)

• php: DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte (CVE-2019-11045)

• php: Information disclosure in exif_read_data() (CVE-2019-11047)

• php: Integer wraparounds when receiving multipart forms (CVE-2019-11048)

• oniguruma: Use-after-free in onig_new_deluxe() in regext.c (CVE-2019-13224)

• oniguruma: NULL pointer dereference in match_at() in regexec.c (CVE-2019-13225)

• oniguruma: Stack exhaustion in regcomp.c because of recursion in regparse.c (CVE-2019-16163)

• oniguruma: Heap-based buffer over-read in function gb18030_mbc_enc_len in file gb18030.c (CVE-2019-19203)

• oniguruma: Heap-based buffer over-read in function fetch_interval_quantifier in regparse.c (CVE-2019-19204)

• pcre: Out of bounds read in JIT mode when \X is used in non-UTF mode (CVE-2019-20454)

• php: Out of bounds read in php_strip_tags_ex (CVE-2020-7059)

• php: Global buffer-overflow in mbfl_filt_conv_big5_wchar function (CVE-2020-7060)

• php: NULL pointer dereference in PHP session upload progress (CVE-2020-7062)

• php: Files added to tar with Phar::buildFromIterator have all-access permissions (CVE-2020-7063)

• php: Information disclosure in exif_read_data() function (CVE-2020-7064)

• php: Using mb_strtolower() function with UTF-32LE encoding leads to potential code execution (CVE-2020-7065)

• php: Heap buffer over-read in exif_scan_thumbnail() (CVE-2019-11041)

• php: Heap buffer over-read in exif_process_user_comment() (CVE-2019-11042)

• php: Out of bounds read when parsing EXIF information (CVE-2019-11050)

• oniguruma: Heap-based buffer overflow in str_lower_case_match in regexec.c (CVE-2019-19246)

• php: Information disclosure in function get_headers (CVE-2020-7066)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Function iconv_mime_decode_headers() in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 may perform out-of-buffer read due to integer overflow when parsing MIME headers. This may lead to information disclosure or crash.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (7.2.24). (BZ#1726981)

Security Fix(es):

• php: Invalid memory access in function xmlrpc_decode() (CVE-2019-9020)

• php: File rename across filesystems may allow unwanted access during processing (CVE-2019-9637)

• php: Uninitialized read in exif_process_IFD_in_MAKERNOTE (CVE-2019-9638)

• php: Uninitialized read in exif_process_IFD_in_MAKERNOTE (CVE-2019-9639)

• php: Invalid read in exif_process_SOFn() (CVE-2019-9640)

• php: Out-of-bounds read due to integer overflow in iconv_mime_decode_headers() (CVE-2019-11039)

• php: Buffer over-read in exif_read_data() (CVE-2019-11040)

• php: Buffer over-read in PHAR reading functions (CVE-2018-20783)

• php: Heap-based buffer over-read in PHAR reading functions (CVE-2019-9021)

• php: memcpy with negative length via crafted DNS response (CVE-2019-9022)

• php: Heap-based buffer over-read in mbstring regular expression functions (CVE-2019-9023)

• php: Out-of-bounds read in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c (CVE-2019-9024)

• php: Heap buffer overflow in function exif_process_IFD_TAG() (CVE-2019-11034)

• php: Heap buffer overflow in function exif_iif_add_value() (CVE-2019-11035)

• php: Buffer over-read in exif_process_IFD_TAG() leading to information disclosure (CVE-2019-11036)

• php: Heap buffer over-read in exif_scan_thumbnail() (CVE-2019-11041)

• php: Heap buffer over-read in exif_process_user_comment() (CVE-2019-11042)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (7.3.20). (BZ#1856655)

Security Fix(es):

• php: Out-of-bounds read due to integer overflow in iconv_mime_decode_headers() (CVE-2019-11039)

• php: Buffer over-read in exif_read_data() (CVE-2019-11040)

• php: DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte (CVE-2019-11045)

• php: Information disclosure in exif_read_data() (CVE-2019-11047)

• php: Integer wraparounds when receiving multipart forms (CVE-2019-11048)

• oniguruma: Use-after-free in onig_new_deluxe() in regext.c (CVE-2019-13224)

• oniguruma: NULL pointer dereference in match_at() in regexec.c (CVE-2019-13225)

• oniguruma: Stack exhaustion in regcomp.c because of recursion in regparse.c (CVE-2019-16163)

• oniguruma: Heap-based buffer over-read in function gb18030_mbc_enc_len in file gb18030.c (CVE-2019-19203)

• oniguruma: Heap-based buffer over-read in function fetch_interval_quantifier in regparse.c (CVE-2019-19204)

• pcre: Out of bounds read in JIT mode when \X is used in non-UTF mode (CVE-2019-20454)

• php: Out of bounds read in php_strip_tags_ex (CVE-2020-7059)

• php: Global buffer-overflow in mbfl_filt_conv_big5_wchar function (CVE-2020-7060)

• php: NULL pointer dereference in PHP session upload progress (CVE-2020-7062)

• php: Files added to tar with Phar::buildFromIterator have all-access permissions (CVE-2020-7063)

• php: Information disclosure in exif_read_data() function (CVE-2020-7064)

• php: Using mb_strtolower() function with UTF-32LE encoding leads to potential code execution (CVE-2020-7065)

• php: Heap buffer over-read in exif_scan_thumbnail() (CVE-2019-11041)

• php: Heap buffer over-read in exif_process_user_comment() (CVE-2019-11042)

• php: Out of bounds read when parsing EXIF information (CVE-2019-11050)

• oniguruma: Heap-based buffer overflow in str_lower_case_match in regexec.c (CVE-2019-19246)

• php: Information disclosure in function get_headers (CVE-2020-7066)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for php7 fixes the following issues:

Security issues fixed:

• CVE-2019-11039: Fixed a heap-buffer-overflow on php_jpg_get16 (bsc#1138173).
• CVE-2019-11040: Fixed an out-of-bounds read due to an integer overflow in iconv.c:_php_iconv_mime_decode() (bsc#1138172).

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the php7-7.4.24-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the php8-8.0.11-1.1 package on the GA media of openSUSE Tumbleweed.

This update for php72 fixes the following issues:

Security issues fixed:

• CVE-2019-11039: Fixed a heap-buffer-overflow on php_jpg_get16 (bsc#1138173).
• CVE-2019-11040: Fixed an out-of-bounds read due to an integer overflow in iconv.c:_php_iconv_mime_decode() (bsc#1138172).

This update for php7 fixes the following issues:

Security issues fixed:

• CVE-2019-11039: Fixed a heap-buffer-overflow on php_jpg_get16 (bsc#1138173).
• CVE-2019-11040: Fixed an out-of-bounds read due to an integer overflow in iconv.c:_php_iconv_mime_decode() (bsc#1138172).

Other issue addressed:

• Enable php7 testsuite (bsc#1119396

This update for php5 fixes the following issues:

Security issues fixed:

• CVE-2019-11039: Fixed a heap-buffer-overflow on php_jpg_get16 (bsc#1138173).
• CVE-2019-11040: Fixed an out-of-bounds read due to an integer overflow in iconv.c:_php_iconv_mime_decode() (bsc#1138172).
• CVE-2015-1351: Fixed a use after free in opcache extension (bsc#1137633).

This update for php7 fixes the following issues:

Security issues fixed:

• CVE-2019-11039: Fixed a heap-buffer-overflow on php_jpg_get16 (bsc#1138173).
• CVE-2019-11040: Fixed an out-of-bounds read due to an integer overflow in iconv.c:_php_iconv_mime_decode() (bsc#1138172).

This update for php7 fixes the following issues:

• Version update to 7.2.34 [jsc#SLE-23639]

• CVE-2022-37454: Fixed SHA-3 buffer overflow (bsc#1204577).

• Fix integer overflow in PHP_SHA3##bits (bsc#1204577#c26).

It was discovered that PHP incorrectly handled certain exif tags in images. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly obtain sensitive information. (CVE-2019-11036)

It was discovered that PHP incorrectly decoding certain MIME headers. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2019-11039)

It was discovered that PHP incorrectly handled certain exif tags in images. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2019-11040)

USN-4009-1 fixed several vulnerabilities in PHP. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.

Original advisory details:

It was discovered that PHP incorrectly decoding certain MIME headers. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2019-11039)

It was discovered that PHP incorrectly handled certain exif tags in images. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2019-11040)