Description

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.

Remediation

References

CVE-2019-11050

Related Vulnerabilities

WordPress Ultimate Member Plugin Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2022-3966)

PHP Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2011-1939)

PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2017-11362)

PHP undefined Safe_Mode_Include_Dir safemode bypass vulnerability

WordPress 4.1.x Multiple Vulnerabilities (4.1 - 4.1.17)

Severity

Medium

Classification

CVE-2019-11050 CWE-125 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Tags

Missing Update Known Vulnerabilities