CVE-2019-11048

In PHP versions 7.2.x below 7.2.31, 7.3.x below 7.3.18 and 7.4.x below 7.4.6, when HTTP file uploads are allowed, supplying overly long filenames or field names could lead PHP engine to try to allocate oversized memory storage, hit the memory limit and stop processing the request, without cleaning up temporary files created by upload request. This potentially could lead to accumulation of uncleaned temporary files exhausting the disk space on the target server.

In PHP versions 7.2.x below 7.2.31, 7.3.x below 7.3.18 and 7.4.x below 7.4.6, when HTTP file uploads are allowed, supplying overly long filenames or field names could lead PHP engine to try to allocate oversized memory storage, hit the memory limit and stop processing the request, without cleaning up temporary files created by upload request. This potentially could lead to accumulation of uncleaned temporary files exhausting the disk space on the target server.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (7.3.20). (BZ#1856655)

Security Fix(es):

• php: Out-of-bounds read due to integer overflow in iconv_mime_decode_headers() (CVE-2019-11039)

• php: Buffer over-read in exif_read_data() (CVE-2019-11040)

• php: DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte (CVE-2019-11045)

• php: Information disclosure in exif_read_data() (CVE-2019-11047)

• php: Integer wraparounds when receiving multipart forms (CVE-2019-11048)

• oniguruma: Use-after-free in onig_new_deluxe() in regext.c (CVE-2019-13224)

• oniguruma: NULL pointer dereference in match_at() in regexec.c (CVE-2019-13225)

• oniguruma: Stack exhaustion in regcomp.c because of recursion in regparse.c (CVE-2019-16163)

• oniguruma: Heap-based buffer over-read in function gb18030_mbc_enc_len in file gb18030.c (CVE-2019-19203)

• oniguruma: Heap-based buffer over-read in function fetch_interval_quantifier in regparse.c (CVE-2019-19204)

• pcre: Out of bounds read in JIT mode when \X is used in non-UTF mode (CVE-2019-20454)

• php: Out of bounds read in php_strip_tags_ex (CVE-2020-7059)

• php: Global buffer-overflow in mbfl_filt_conv_big5_wchar function (CVE-2020-7060)

• php: NULL pointer dereference in PHP session upload progress (CVE-2020-7062)

• php: Files added to tar with Phar::buildFromIterator have all-access permissions (CVE-2020-7063)

• php: Information disclosure in exif_read_data() function (CVE-2020-7064)

• php: Using mb_strtolower() function with UTF-32LE encoding leads to potential code execution (CVE-2020-7065)

• php: Heap buffer over-read in exif_scan_thumbnail() (CVE-2019-11041)

• php: Heap buffer over-read in exif_process_user_comment() (CVE-2019-11042)

• php: Out of bounds read when parsing EXIF information (CVE-2019-11050)

• oniguruma: Heap-based buffer overflow in str_lower_case_match in regexec.c (CVE-2019-19246)

• php: Information disclosure in function get_headers (CVE-2020-7066)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In PHP versions 7.2.x below 7.2.31, 7.3.x below 7.3.18 and 7.4.x below 7.4.6, when HTTP file uploads are allowed, supplying overly long filenames or field names could lead PHP engine to try to allocate oversized memory storage, hit the memory limit and stop processing the request, without cleaning up temporary files created by upload request. This potentially could lead to accumulation of uncleaned temporary files exhausting the disk space on the target server.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (7.3.20). (BZ#1856655)

Security Fix(es):

• php: Out-of-bounds read due to integer overflow in iconv_mime_decode_headers() (CVE-2019-11039)

• php: Buffer over-read in exif_read_data() (CVE-2019-11040)

• php: DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte (CVE-2019-11045)

• php: Information disclosure in exif_read_data() (CVE-2019-11047)

• php: Integer wraparounds when receiving multipart forms (CVE-2019-11048)

• oniguruma: Use-after-free in onig_new_deluxe() in regext.c (CVE-2019-13224)

• oniguruma: NULL pointer dereference in match_at() in regexec.c (CVE-2019-13225)

• oniguruma: Stack exhaustion in regcomp.c because of recursion in regparse.c (CVE-2019-16163)

• oniguruma: Heap-based buffer over-read in function gb18030_mbc_enc_len in file gb18030.c (CVE-2019-19203)

• oniguruma: Heap-based buffer over-read in function fetch_interval_quantifier in regparse.c (CVE-2019-19204)

• pcre: Out of bounds read in JIT mode when \X is used in non-UTF mode (CVE-2019-20454)

• php: Out of bounds read in php_strip_tags_ex (CVE-2020-7059)

• php: Global buffer-overflow in mbfl_filt_conv_big5_wchar function (CVE-2020-7060)

• php: NULL pointer dereference in PHP session upload progress (CVE-2020-7062)

• php: Files added to tar with Phar::buildFromIterator have all-access permissions (CVE-2020-7063)

• php: Information disclosure in exif_read_data() function (CVE-2020-7064)

• php: Using mb_strtolower() function with UTF-32LE encoding leads to potential code execution (CVE-2020-7065)

• php: Heap buffer over-read in exif_scan_thumbnail() (CVE-2019-11041)

• php: Heap buffer over-read in exif_process_user_comment() (CVE-2019-11042)

• php: Out of bounds read when parsing EXIF information (CVE-2019-11050)

• oniguruma: Heap-based buffer overflow in str_lower_case_match in regexec.c (CVE-2019-19246)

• php: Information disclosure in function get_headers (CVE-2020-7066)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• Fix bug #69720: Null pointer dereference in phar_get_fp_offset()
• Fix bug #70728: Type Confusion Vulnerability in PHP_to_XMLRPC_worker()
• Fix bug #70661: Use After Free Vulnerability in WDDX Packet Deserialization
• Fix bug #70741: Session WDDX Packet Deserialization Type Confusion Vulnerability
• Fix bug #71459: Integer overflow in iptcembed()
• Fix bug #71039: exec functions ignore length but look for NULL termination
• Fix bug #71354: Heap corruption in tar/zip/phar parser.
• Fix bug #71391: NULL Pointer Dereference in phar_tar_setupmetadata()
• Fix bug #71323: Output of stream_get_meta_data can be falsified by its input
• Fix bug #71498: Out-of-Bound Read in phar_parse_zipfile()
• Fix bug #71587: Use-After-Free / Double-Free in WDDX Deserialize
• Fix bug #71860: Invalid memory write in phar on filename with \0 in name
• Fix bug #71798: Integer Overflow in php_raw_url_encode
• Fix bug #72837: integer overflow in bzdecompress caused heap corruption
• Fix bug #72681: PHP Session Data Injection Vulnerability
• Fix bug #72807: integer overflow in curl_escape caused heap corruption
• Fix bug #72838: Integer overflow lead to heap corruption in sql_regcase
• Fix bug #72697: select_colors write out-of-bounds
• Fix bug #72730: imagegammacorrect allows arbitrary write access
• Fix bug #72836: integer overflow in base64_decode caused heap corruption
• Fix bug #72848: integer overflow in quoted_printable_encode caused heap corruption
• Fix bug #72849: integer overflow in urlencode caused heap corruption
• Fix bug #72850: integer overflow in php_uuencode caused heap corruption
• Fix bug #72771: ftps:// wrapper is vulnerable to protocol downgrade attack
• Fix bug #72749: wddx_deserialize allows illegal memory access
• Fix bug #72750: wddx_deserialize null dereference
• Fix bug #72790: wddx_deserialize null dereference with invalid xml
• Fix bug #72799: wddx_deserialize null dereference in php_wddx_pop_element
• Fix bug #73189: Memcpy negative size parameter php_resolve_path
• Fix bug #73150: missing NULL check in dom_document_save_html
• Fix bug #73284: heap overflow in php_ereg_replace function
• Fix bug #73218: stack-buffer-overflow through "ResourceBundle" methods
• Fix bug #73208: integer overflow in imap_8bit caused heap corruption
• Fix bug #73082: string length overflow in mb_encode_* function
• Fix bug #73174: heap overflow in php_pcre_replace_impl
• Fix bug #73276: crash in openssl_random_pseudo_bytes function
• Fix bug #73275: crash in openssl_encrypt function
• Fix bug #73017: memory corruption in wordwrap function
• Fix bug #73240: Write out of bounds at number_format
• Fix bug #73073: CachingIterator null dereference when convert to string
• Fix bug #73293: NULL pointer dereference in SimpleXMLElement::asXML()
• Fix bug #73356: crash in bzcompress function
• Fix bug #72696: imagefilltoborder stackoverflow on truecolor images
• Fix bug #73418: Integer Overflow in "_php_imap_mail" leads Heap Overflow
• Fix bug #73144: Use-after-free in ArrayObject Deserialization
• Fix bug #73192: parse_url return wrong hostname
• Fix bug #73331: NULL Pointer Dereference in WDDX Packet Deserialization with PDORow
• Fix bug #73452: Segfault (Regression for #69152)
• Fix bug #73631: Invalid read when wddx decodes empty boolean element
• Fix bug #67587: Redirection loop on nginx with FPM
• Fix bug #71465: PHAR doesn't know about litespeed
• Fix bug #73737: FPE when parsing a tag format
• Fix bug #73868: Fix DOS vulnerability in gdImageCreateFromGd2Ctx()
• Fix bug #73869: Signed Integer Overflow gd_io.c
• Fix bug #73773: Seg fault when loading hostile phar
• Fix bug #70436: Use After Free Vulnerability in unserialize()
• Fix bug #74603: PHP INI Parsing Stack Buffer Overflow Vulnerability
• Fix bug #72535: arcfour encryption stream filter crashes php
• Fix bug #72434: ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unseria
• Fix bug #72455: Heap Overflow due to integer overflows
• Fix bug #74782:…

• CVE-2018-5711: fix infinite loop in gdImageCreateFromGifCtx
• CVE-2018-5712: remove file name from phar stub error output (XSS)
• CVE-2018-10545: do not set PR_SET_DUMPABLE in php-fpm workers by default
• CVE-2018-10546: fail iconv_mime_decode on invalid multibyte sequences
• CVE-2018-10547: escape file name in phar fallback paths (XSS)
• CVE-2018-10548: validate LDAP value list pointer to avoid crash
• CVE-2018-14851: use MAKERNOTE length as data size in exif IFD walk
• CVE-2018-17082: reset Apache brigade after flush failure to avoid XSS
• CVE-2019-11041: reject thumbnails smaller than 4 bytes in exif scan
• CVE-2019-11045: reject NUL bytes in DirectoryIterator path argument
• CVE-2019-11046: use ASCII range check instead of locale isdigit in bcmath
• CVE-2019-11047: bound MakerNote id_string compare by value_len
• CVE-2019-11048: widen length types in rfc1867 multipart upload handler
• CVE-2019-11050: subtract loop offset from data_len in exif IFD walk

Updated php packages fix security vulnerabilities:

• Fixed bug #78875 (Long filenames cause OOM and temp files are not cleaned). [1]
• Fixed bug #78876 (Long variables in multipart/form-data cause OOM and temp files are not cleaned). [2]
• Fixed bug #79441 (Segfault in mb_chr() if internal encoding is unsupported).
• Fixed bug #79491 (Search for .user.iniFixed bug #79468 (SIGSEGV when closing stream handle with a stream filter appended). extends up to root dir).

This update for php7 fixes the following issues:

Security issue fixed:

• CVE-2019-11048: Improved the handling of overly long filenames or field names in HTTP file uploads (bsc#1171999).

This update was imported from the SUSE:SLE-15:Update update project.

This update for php7 fixes the following issues:

Security issue fixed:

• CVE-2019-11048: Improved the handling of overly long filenames or field names in HTTP file uploads (bsc#1171999).

This update for php72 fixes the following issues:

• CVE-2020-7064: Fixed a one byte read of uninitialized memory in exif_read_data() (bsc#1168326).
• CVE-2020-7066: Fixed URL truncation get_headers() if the URL contains zero (\0) character (bsc#1168352).
• CVE-2019-11048: Improved the handling of overly long filenames or field names in HTTP file uploads (bsc#1171999).

This update for php7 fixes the following issues:

Security issue fixed:

• CVE-2019-11048: Improved the handling of overly long filenames or field names in HTTP file uploads (bsc#1171999).

This update for php7 fixes the following issues:

Security issue fixed:

• CVE-2019-11048: Improved the handling of overly long filenames or field names in HTTP file uploads (bsc#1171999).

This update for php5 fixes the following issues:

• CVE-2020-7064: Fixed a one byte read of uninitialized memory in exif_read_data() (bsc#1168326).
• CVE-2020-7066: Fixed URL truncation get_headers() if the URL contains zero (\0) character (bsc#1168352).
• CVE-2019-11048: Improved the handling of overly long filenames or field names in HTTP file uploads (bsc#1171999).

This update for php7 fixes the following issues:

• Version update to 7.2.34 [jsc#SLE-23639]

• CVE-2022-37454: Fixed SHA-3 buffer overflow (bsc#1204577).

• Fix integer overflow in PHP_SHA3##bits (bsc#1204577#c26).

It was discovered that PHP incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service.