Description

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.

Remediation

References

CVE-2019-11050

Related Vulnerabilities

Moodle Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2023-28335)

Oracle HTTP Server CVE-2013-1862 Vulnerability (CVE-2013-1862)

markdown-it Inefficient Regular Expression Complexity Vulnerability (CVE-2022-21670)

Apache HTTP Server Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2021-41773)

WordPress URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2018-10101)

Severity

Medium

Classification

CVE-2019-11050 CWE-125 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Tags

Missing Update Known Vulnerabilities