Every CVE Search/ Get API key

CVE-2019-9675

** DISPUTED ** An issue was discovered in PHP 7.x before 7.1.27 and 7.3.x before 7.3.3....

8.1 HighFix availableDisputed

An issue was discovered in PHP 7.x before 7.1.27 and 7.3.x before 7.3.3. phar_tar_writeheaders_int in ext/phar/tar.c has a buffer overflow via a long link value. NOTE: The vendor indicates that the link value is used only when an archive contains a symlink, which currently cannot happen: "This issue allows theoretical compromise of security, but a practical attack is usually impossible.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

6.02%Up 4.2 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 8.1

An issue was discovered in PHP 7.x before 7.1.27 and 7.3.x before 7.3.3. phar_tar_writeheaders_int in ext/phar/tar.c has a buffer overflow via a long link value. NOTE: The vendor indicates that the link value is used only when an archive contains a symlink, which currently cannot happen: "This issue allows theoretical compromise of security, but a practical attack is usually impossible.

Record
CVE-2019-9675
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

An issue was discovered in PHP 7.x before 7.1.27 and 7.3.x before 7.3.3. phar_tar_writeheaders_int in ext/phar/tar.c has a buffer overflow via a long link value. NOTE: The vendor indicates that the link value is used only when an archive contains a symlink, which currently cannot happen: "This issue allows theoretical compromise of security, but a practical attack is usually impossible.

Record
CVE-2019-9675
Updated
2026-11-02
EUVDEUVD-2019-19041 No score

An issue was discovered in PHP 7.x before 7.1.27 and 7.3.x before 7.3.3. phar_tar_writeheaders_int in ext/phar/tar.c has a buffer overflow via a long link value. NOTE: The vendor indicates that the link value is used only when an archive contains a symlink, which currently cannot happen: "This issue allows theoretical compromise of security, but a practical attack is usually impossible.

Record
EUVD-2019-19041
Updated
2026-11-03
GitHub AdvisoriesGHSA-pf47-4qf3-xq2x 8.1

** DISPUTED ** An issue was discovered in PHP 7.x before 7.1.27 and 7.3.x before 7.3.3....

** DISPUTED ** An issue was discovered in PHP 7.x before 7.1.27 and 7.3.x before 7.3.3. phar_tar_writeheaders_int in ext/phar/tar.c has a buffer overflow via a long link value. NOTE: The vendor indicates that the link value is used only when an archive contains a symlink, which currently cannot happen: "This issue allows theoretical compromise of security, but a practical attack is usually impossible."

Record
GHSA-pf47-4qf3-xq2x
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-119
Updated
2026-11-02
OSVBELL-CVE-2019-9675 8.1

CVE-2019-9675 does not affect BellSoft software

Record
BELL-CVE-2019-9675
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 8.1

An issue was discovered in PHP 7.x before 7.1.27 and 7.3.x before 7.3.3. phar_tar_writeheaders_int in ext/phar/tar.c has a buffer overflow via a long link value. NOTE: The vendor indicates that the link value is used only when an archive contains a symlink, which currently cannot happen: "This issue allows theoretical compromise of security, but a practical attack is usually impossible.

Record
CVE-2019-9675
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 11 moreShow less
OSVUBUNTU-CVE-2019-9675 8.1

An issue was discovered in PHP 7.x before 7.1.27 and 7.3.x before 7.3.3. phar_tar_writeheaders_int in ext/phar/tar.c has a buffer overflow via a long link value. NOTE: The vendor indicates that the link value is used only when an archive contains a symlink, which currently cannot happen: "This issue allows theoretical compromise of security, but a practical attack is usually impossible.

Record
UBUNTU-CVE-2019-9675
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2019:1572-1 No score

Security update for php7

This update for php7 fixes the following issues:

Security issues fixed:

  • CVE-2019-9637: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128892).
  • CVE-2019-9675: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128886).
  • CVE-2019-9638: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension ((bsc#1128889).
  • CVE-2019-9639: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128887).
  • CVE-2019-9640: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128883).
  • CVE-2019-9022: Fixed a vulnerability which could allow a hostile DNS server to make PHP misuse memcpy (bsc#1126827).
  • CVE-2019-9024: Fixed a vulnerability in xmlrpc_decode function which could allow to a hostile XMLRPC server to cause memory read outside the allocated areas (bsc#1126821).
  • CVE-2019-9020: Fixed a heap out of bounds in xmlrpc_decode function (bsc#1126711).
  • CVE-2018-20783: Fixed a buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1127122).
  • CVE-2019-9021: Fixed a heap buffer-based buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1126713).
  • CVE-2019-9023: Fixed multiple heap-based buffer over-read instances in mbstring regular expression functions (bsc#1126823).
  • CVE-2019-9641: Fixed multiple invalid memory access in EXIF extension and improved insecure implementation of rename function (bsc#1128722).
  • CVE-2018-19935: Fixed a Denial of Service in php_imap.c which could be triggered via an empty string in the message argument to imap_mail (bsc#1118832).
  • CVE-2019-11034: Fixed a heap-buffer overflow in php_ifd_get32si() (bsc#1132838).
  • CVE-2019-11035: Fixed a heap-buffer overflow in exif_iif_add_value() (bsc#1132837).
  • CVE-2019-11036: Fixed buffer over-read in exif_process_IFD_TAG function leading to information disclosure (bsc#1134322).

Other issue addressed:

  • Deleted README.default_socket_timeout which is not needed anymore (bsc#1129032).
  • Enabled php7 testsuite (bsc#1119396).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:1572-1
Updated
2026-11-02
OSVopenSUSE-SU-2019:1573-1 No score

Security update for php7

This update for php7 fixes the following issues:

Security issues fixed:

  • CVE-2019-9637: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128892).
  • CVE-2019-9675: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128886).
  • CVE-2019-9638: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension ((bsc#1128889).
  • CVE-2019-9639: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128887).
  • CVE-2019-9640: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128883).
  • CVE-2019-9022: Fixed a vulnerability which could allow a hostile DNS server to make PHP misuse memcpy (bsc#1126827).
  • CVE-2019-9024: Fixed a vulnerability in xmlrpc_decode function which could allow to a hostile XMLRPC server to cause memory read outside the allocated areas (bsc#1126821).
  • CVE-2019-9020: Fixed a heap out of bounds in xmlrpc_decode function (bsc#1126711).
  • CVE-2018-20783: Fixed a buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1127122).
  • CVE-2019-9021: Fixed a heap buffer-based buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1126713).
  • CVE-2019-9023: Fixed multiple heap-based buffer over-read instances in mbstring regular expression functions (bsc#1126823).
  • CVE-2019-9641: Fixed multiple invalid memory access in EXIF extension and improved insecure implementation of rename function (bsc#1128722).
  • CVE-2018-19935: Fixed a Denial of Service in php_imap.c which could be triggered via an empty string in the message argument to imap_mail (bsc#1118832).
  • CVE-2019-11034: Fixed a heap-buffer overflow in php_ifd_get32si() (bsc#1132838).
  • CVE-2019-11035: Fixed a heap-buffer overflow in exif_iif_add_value() (bsc#1132837).
  • CVE-2019-11036: Fixed buffer over-read in exif_process_IFD_TAG function leading to information disclosure (bsc#1134322).

Other issue addressed:

  • Deleted README.default_socket_timeout which is not needed anymore (bsc#1129032).
  • Enabled php7 testsuite (bsc#1119396).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:1573-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11167-1 No score

php7-7.4.24-1.1 on GA media

These are all security issues fixed in the php7-7.4.24-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11167-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11169-1 No score

php8-8.0.11-1.1 on GA media

These are all security issues fixed in the php8-8.0.11-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11169-1
Updated
2026-11-02
OSVSUSE-SU-2019:0988-1 No score

Security update for php72

This update for php72 fixes the following issues:

  • CVE-2019-9637: Due to the way rename() across filesystems is implemented, it was possible that file being renamed is briefly available with wrong permissions while the rename is ongoing, thus enabling unauthorized users to access the data. (bsc#1128892)
  • CVE-2019-9675: phar_tar_writeheaders_int in ext/phar/tar.c has a buffer overflow via a long link value. NOTE: The vendor indicates that the link value is used only when an archive contains a symlink, which currently cannot happen: 'This issue allows theoretical compromise of security, but a practical attack is usually impossible.' (bsc#1128886)
  • CVE-2019-9638: An issue was discovered in the EXIF component in PHP. There was an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling the maker_note->offset relationship to value_len. (bsc#1128889)
  • CVE-2019-9639: An issue was discovered in the EXIF component in PHP. There was an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling the data_len variable. (bsc#1128887)
  • CVE-2019-9640: An issue was discovered in the EXIF component in PHP. There was an Invalid Read in exif_process_SOFn. (bsc#1128883)
Record
SUSE-SU-2019:0988-1
Updated
2026-11-02
OSVSUSE-SU-2019:1325-1 No score

Security update for php5

This update for php5 fixes the following issues:

Security issues fixed:

  • CVE-2019-11034: Fixed a heap-buffer overflow in php_ifd_get32si() (bsc#1132838).
  • CVE-2019-11035: Fixed a heap-buffer overflow in exif_iif_add_value() (bsc#1132837).
  • CVE-2019-9637: Fixed a potential information disclosure in rename() (bsc#1128892).
  • CVE-2019-9675: Fixed a potential buffer overflow in phar_tar_writeheaders_int() (bsc#1128886).
  • CVE-2019-9638: Fixed an uninitialized read in exif_process_IFD_in_MAKERNOTE() related to value_len (bsc#1128889).
  • CVE-2019-9639: Fixed an uninitialized read in exif_process_IFD_in_MAKERNOTE() related to data_len (bsc#1128887).
  • CVE-2019-9640: Fixed an invalid Read in exif_process_SOFn() (bsc#1128883).
  • CVE-2019-11036: Fixed buffer over-read in exif_process_IFD_TAG function leading to information disclosure (bsc#1134322).
Record
SUSE-SU-2019:1325-1
Updated
2026-11-02
OSVSUSE-SU-2019:14013-1 No score

Security update for php53

This update for php53 fixes the following issues:

Security issues fixed:

  • CVE-2019-9637: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128892).
  • CVE-2019-9675: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128886).
  • CVE-2019-9638: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension ((bsc#1128889).
  • CVE-2019-9639: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128887).
  • CVE-2019-9640: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128883).
  • CVE-2019-9024: Fixed a vulnerability in xmlrpc_decode function which could allow to a hostile XMLRPC server to cause memory read outside the allocated areas (bsc#1126821).
  • CVE-2019-9020: Fixed a heap out of bounds in xmlrpc_decode function (bsc#1126711).
  • CVE-2018-20783: Fixed a buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1127122).
  • CVE-2019-9021: Fixed a heap buffer-based buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1126713).
  • CVE-2019-9023: Fixed multiple heap-based buffer over-read instances in mbstring regular expression functions (bsc#1126823).
  • CVE-2019-9641: Fixed multiple invalid memory access in EXIF extension and improved insecure implementation of rename function (bsc#1128722).
Record
SUSE-SU-2019:14013-1
Updated
2026-11-02
OSVSUSE-SU-2019:1461-1 No score

Security update for php7

This update for php7 fixes the following issues:

Security issues fixed:

  • CVE-2019-9637: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128892).
  • CVE-2019-9675: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128886).
  • CVE-2019-9638: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension ((bsc#1128889).
  • CVE-2019-9639: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128887).
  • CVE-2019-9640: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128883).
  • CVE-2019-9022: Fixed a vulnerability which could allow a hostile DNS server to make PHP misuse memcpy (bsc#1126827).
  • CVE-2019-9024: Fixed a vulnerability in xmlrpc_decode function which could allow to a hostile XMLRPC server to cause memory read outside the allocated areas (bsc#1126821).
  • CVE-2019-9020: Fixed a heap out of bounds in xmlrpc_decode function (bsc#1126711).
  • CVE-2018-20783: Fixed a buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1127122).
  • CVE-2019-9021: Fixed a heap buffer-based buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1126713).
  • CVE-2019-9023: Fixed multiple heap-based buffer over-read instances in mbstring regular expression functions (bsc#1126823).
  • CVE-2019-9641: Fixed multiple invalid memory access in EXIF extension and improved insecure implementation of rename function (bsc#1128722).
  • CVE-2018-19935: Fixed a Denial of Service in php_imap.c which could be triggered via an empty string in the message argument to imap_mail (bsc#1118832).
  • CVE-2019-11034: Fixed a heap-buffer overflow in php_ifd_get32si() (bsc#1132838).
  • CVE-2019-11035: Fixed a heap-buffer overflow in exif_iif_add_value() (bsc#1132837).
  • CVE-2019-11036: Fixed buffer over-read in exif_process_IFD_TAG function leading to information disclosure (bsc#1134322).

Other issue addressed:

  • Deleted README.default_socket_timeout which is not needed anymore (bsc#1129032).
  • Enabled php7 testsuite (bsc#1119396).
Record
SUSE-SU-2019:1461-1
Updated
2026-11-02
OSVSUSE-SU-2022:4067-1 No score

Security update for php7

This update for php7 fixes the following issues:

  • Version update to 7.2.34 [jsc#SLE-23639]

  • CVE-2022-37454: Fixed SHA-3 buffer overflow (bsc#1204577).

  • Fix integer overflow in PHP_SHA3##bits (bsc#1204577#c26).

Record
SUSE-SU-2022:4067-1
Updated
2026-11-02
OSVUSN-3922-2 No score

php5 vulnerabilities

USN-3922-1 fixed vulnerabilities in PHP. This update provides the corresponding update for Ubuntu 14.04 LTS.

It was discovered that PHP incorrectly handled certain files. An attacker could possibly use this issue to access sensitive information. (CVE-2019-9022)

It was discovered that PHP incorrectly handled certain files. An attacker could possibly use this issue to execute arbitrary code. (CVE-2019-9675)

Original advisory details:

It was discovered that PHP incorrectly handled certain inputs. An attacker could possibly use this issue to expose sensitive information. (CVE-2019-9637, CVE-2019-9638, CVE-2019-9639, CVE-2019-9640, CVE-2019-9641)

Record
USN-3922-2
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
php7.0
Debian:9
From an advisory covering 6 CVEs
 before 7.0.33-0+deb9u3, plus listed versions
7.0.19-17.0.20-17.0.20-27.0.22-17.0.22-2
Show 14 moreShow less
7.0.22-37.0.25-17.0.26-17.0.27-0+deb9u17.0.27-17.0.28-17.0.29-17.0.30-0+deb9u17.0.30-17.0.30-27.0.31-17.0.32-17.0.33-0+deb9u17.0.33-0+deb9u2
7.0.33-0+deb9u3
php72
SUSE:Linux Enterprise Module for Web and Scripting 12
From an advisory covering 5 CVEs
 before 7.2.5-1.10.1
7.2.5-1.10.1
php72
SUSE:Linux Enterprise Software Development Kit 12 SP3
From an advisory covering 5 CVEs
 before 7.2.5-1.10.1
7.2.5-1.10.1
php72
SUSE:Linux Enterprise Software Development Kit 12 SP4
From an advisory covering 5 CVEs
 before 7.2.5-1.10.1
7.2.5-1.10.1
php5
SUSE:Linux Enterprise Module for Web and Scripting 12
From an advisory covering 8 CVEs
 before 5.5.14-109.58.1
5.5.14-109.58.1
php5
SUSE:Linux Enterprise Software Development Kit 12 SP3
From an advisory covering 8 CVEs
 before 5.5.14-109.58.1
5.5.14-109.58.1
php5
SUSE:Linux Enterprise Software Development Kit 12 SP4
From an advisory covering 8 CVEs
 before 5.5.14-109.58.1
5.5.14-109.58.1
php53
SUSE:Linux Enterprise Software Development Kit 11 SP4
From an advisory covering 11 CVEs
 before 5.3.17-112.58.1
5.3.17-112.58.1
php53
SUSE:Linux Enterprise Point of Sale 11 SP3
From an advisory covering 11 CVEs
 before 5.3.17-112.58.1
5.3.17-112.58.1
php53
SUSE:Linux Enterprise Server 11 SP4
From an advisory covering 11 CVEs
 before 5.3.17-112.58.1
5.3.17-112.58.1
Show 22 moreShow less
Affected packages
PackageAffectedFixed
php53
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
From an advisory covering 11 CVEs
 before 5.3.17-112.58.1
5.3.17-112.58.1
php7
SUSE:Linux Enterprise Module for Package Hub 15
From an advisory covering 16 CVEs
 before 7.2.5-4.32.1
7.2.5-4.32.1
php7
SUSE:Linux Enterprise Module for Web and Scripting 15
From an advisory covering 16 CVEs
 before 7.2.5-4.32.1
7.2.5-4.32.1
php7
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
From an advisory covering 52 CVEs
 before 7.2.34-150000.4.103.1
7.2.34-150000.4.103.1
php7
SUSE:Linux Enterprise High Performance Computing 15-LTSS
From an advisory covering 52 CVEs
 before 7.2.34-150000.4.103.1
7.2.34-150000.4.103.1
php7
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
From an advisory covering 52 CVEs
 before 7.2.34-150000.4.103.1
7.2.34-150000.4.103.1
php7
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
From an advisory covering 52 CVEs
 before 7.2.34-150000.4.103.1
7.2.34-150000.4.103.1
php7
SUSE:Linux Enterprise Server 15-LTSS
From an advisory covering 52 CVEs
 before 7.2.34-150000.4.103.1
7.2.34-150000.4.103.1
php7
SUSE:Linux Enterprise Server 15 SP1-BCL
From an advisory covering 52 CVEs
 before 7.2.34-150000.4.103.1
7.2.34-150000.4.103.1
php7
SUSE:Linux Enterprise Server 15 SP1-LTSS
From an advisory covering 52 CVEs
 before 7.2.34-150000.4.103.1
7.2.34-150000.4.103.1
php7
SUSE:Linux Enterprise Server for SAP Applications 15
From an advisory covering 52 CVEs
 before 7.2.34-150000.4.103.1
7.2.34-150000.4.103.1
php7
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
From an advisory covering 52 CVEs
 before 7.2.34-150000.4.103.1
7.2.34-150000.4.103.1
php7
SUSE:Enterprise Storage 6
From an advisory covering 52 CVEs
 before 7.2.34-150000.4.103.1
7.2.34-150000.4.103.1
php7
openSUSE:Leap 15.4
From an advisory covering 52 CVEs
 before 7.2.34-150000.4.103.1
7.2.34-150000.4.103.1
php5
Ubuntu:14.04:LTS
 before 5.5.9+dfsg-1ubuntu4.29, plus listed versions
5.5.3+dfsg-1ubuntu25.5.3+dfsg-1ubuntu35.5.6+dfsg-1ubuntu15.5.6+dfsg-1ubuntu25.5.8+dfsg-2ubuntu1
Show 27 moreShow less
5.5.9+dfsg-1ubuntu15.5.9+dfsg-1ubuntu25.5.9+dfsg-1ubuntu35.5.9+dfsg-1ubuntu45.5.9+dfsg-1ubuntu4.15.5.9+dfsg-1ubuntu4.25.5.9+dfsg-1ubuntu4.35.5.9+dfsg-1ubuntu4.45.5.9+dfsg-1ubuntu4.55.5.9+dfsg-1ubuntu4.65.5.9+dfsg-1ubuntu4.75.5.9+dfsg-1ubuntu4.95.5.9+dfsg-1ubuntu4.115.5.9+dfsg-1ubuntu4.125.5.9+dfsg-1ubuntu4.135.5.9+dfsg-1ubuntu4.145.5.9+dfsg-1ubuntu4.165.5.9+dfsg-1ubuntu4.175.5.9+dfsg-1ubuntu4.195.5.9+dfsg-1ubuntu4.205.5.9+dfsg-1ubuntu4.215.5.9+dfsg-1ubuntu4.225.5.9+dfsg-1ubuntu4.235.5.9+dfsg-1ubuntu4.245.5.9+dfsg-1ubuntu4.255.5.9+dfsg-1ubuntu4.265.5.9+dfsg-1ubuntu4.27
5.5.9+dfsg-1ubuntu4.29
php7.0
Ubuntu:16.04:LTS
 before 7.0.33-0ubuntu0.16.04.3, plus listed versions
7.0.1-57.0.1-67.0.2-17.0.2-37.0.2-4
Show 24 moreShow less
7.0.2-57.0.3-27.0.3-37.0.3-9ubuntu17.0.4-5ubuntu17.0.4-5ubuntu27.0.4-7ubuntu17.0.4-7ubuntu27.0.4-7ubuntu2.17.0.8-0ubuntu0.16.04.17.0.8-0ubuntu0.16.04.27.0.8-0ubuntu0.16.04.37.0.13-0ubuntu0.16.04.17.0.15-0ubuntu0.16.04.17.0.15-0ubuntu0.16.04.27.0.15-0ubuntu0.16.04.47.0.18-0ubuntu0.16.04.17.0.22-0ubuntu0.16.04.17.0.25-0ubuntu0.16.04.17.0.28-0ubuntu0.16.04.17.0.30-0ubuntu0.16.04.17.0.32-0ubuntu0.16.04.17.0.33-0ubuntu0.16.04.17.0.33-0ubuntu0.16.04.2
7.0.33-0ubuntu0.16.04.3
php7.2
Ubuntu:18.04:LTS
 before 7.2.15-0ubuntu0.18.04.2, plus listed versions
7.2.1-1ubuntu27.2.2-1ubuntu17.2.2-1ubuntu27.2.3-1ubuntu17.2.5-0ubuntu0.18.04.1
Show 4 moreShow less
7.2.7-0ubuntu0.18.04.17.2.7-0ubuntu0.18.04.27.2.10-0ubuntu0.18.04.17.2.15-0ubuntu0.18.04.1
7.2.15-0ubuntu0.18.04.2
php5
Ubuntu:14.04:LTS
From an advisory covering 7 CVEs
 before 5.5.9+dfsg-1ubuntu4.29, plus listed versions
5.5.3+dfsg-1ubuntu25.5.3+dfsg-1ubuntu35.5.6+dfsg-1ubuntu15.5.6+dfsg-1ubuntu25.5.8+dfsg-2ubuntu1
Show 27 moreShow less
5.5.9+dfsg-1ubuntu15.5.9+dfsg-1ubuntu25.5.9+dfsg-1ubuntu35.5.9+dfsg-1ubuntu45.5.9+dfsg-1ubuntu4.15.5.9+dfsg-1ubuntu4.25.5.9+dfsg-1ubuntu4.35.5.9+dfsg-1ubuntu4.45.5.9+dfsg-1ubuntu4.55.5.9+dfsg-1ubuntu4.65.5.9+dfsg-1ubuntu4.75.5.9+dfsg-1ubuntu4.95.5.9+dfsg-1ubuntu4.115.5.9+dfsg-1ubuntu4.125.5.9+dfsg-1ubuntu4.135.5.9+dfsg-1ubuntu4.145.5.9+dfsg-1ubuntu4.165.5.9+dfsg-1ubuntu4.175.5.9+dfsg-1ubuntu4.195.5.9+dfsg-1ubuntu4.205.5.9+dfsg-1ubuntu4.215.5.9+dfsg-1ubuntu4.225.5.9+dfsg-1ubuntu4.235.5.9+dfsg-1ubuntu4.245.5.9+dfsg-1ubuntu4.255.5.9+dfsg-1ubuntu4.265.5.9+dfsg-1ubuntu4.27
5.5.9+dfsg-1ubuntu4.29
php7
openSUSE:Leap 15.1
From an advisory covering 16 CVEs
 before 7.2.5-lp151.6.3.1
7.2.5-lp151.6.3.1
php7
openSUSE:Leap 15.0
From an advisory covering 16 CVEs
 before 7.2.5-lp150.2.19.1
7.2.5-lp150.2.19.1
php7
openSUSE:Tumbleweed
From an advisory covering 44 CVEs
 before 7.4.24-1.1
7.4.24-1.1
php8
openSUSE:Tumbleweed
From an advisory covering 97 CVEs
 before 8.0.11-1.1
8.0.11-1.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-9675 is a high vulnerability (CVSS 8.1) in Php, published March 8, 2019. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 6.02%, the 93rd percentile. Fixed in php5 5.5.9+dfsg-1ubuntu4.29.

References

Show 164 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open