Critical severity9.1NVD Advisory· Published May 3, 2019· Updated Jun 17, 2026

CVE-2019-11036

Description

When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.29, 7.2.x below 7.2.18 and 7.3.x below 7.3.5 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

PHP/PHP2 versions
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:php:php:*:*:*:*:*:*:*:*range: >=7.1.0,<7.1.29
- (no CPE)range: 7.1.x
Red Hat/Software Collections
cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*
Canonical/Ubuntu Linux6 versions
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*+ 5 more
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*
Debian/linux3 versions
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Fedoraproject/Fedora3 versions
cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
OpenSUSE/Leap3 versions
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*
PHP/zip extensionllm-fuzzy
Range: <7.1.29, <7.2.18, <7.3.5
osv-coords61 versions
pkg:rpm/almalinux/apcu-panel pkg:rpm/almalinux/libzip pkg:rpm/almalinux/libzip-devel pkg:rpm/almalinux/libzip-tools pkg:rpm/almalinux/php pkg:rpm/almalinux/php-bcmath pkg:rpm/almalinux/php-cli pkg:rpm/almalinux/php-common pkg:rpm/almalinux/php-dba pkg:rpm/almalinux/php-dbg pkg:rpm/almalinux/php-devel pkg:rpm/almalinux/php-embedded pkg:rpm/almalinux/php-enchant pkg:rpm/almalinux/php-fpm pkg:rpm/almalinux/php-gd pkg:rpm/almalinux/php-gmp pkg:rpm/almalinux/php-intl pkg:rpm/almalinux/php-json pkg:rpm/almalinux/php-ldap pkg:rpm/almalinux/php-mbstring pkg:rpm/almalinux/php-mysqlnd pkg:rpm/almalinux/php-odbc pkg:rpm/almalinux/php-opcache pkg:rpm/almalinux/php-pdo pkg:rpm/almalinux/php-pear pkg:rpm/almalinux/php-pecl-apcu pkg:rpm/almalinux/php-pecl-apcu-devel pkg:rpm/almalinux/php-pecl-zip pkg:rpm/almalinux/php-pgsql pkg:rpm/almalinux/php-process pkg:rpm/almalinux/php-recode pkg:rpm/almalinux/php-snmp pkg:rpm/almalinux/php-soap pkg:rpm/almalinux/php-xml pkg:rpm/almalinux/php-xmlrpc pkg:rpm/opensuse/php7&distro=openSUSE%20Leap%2015.0 pkg:rpm/opensuse/php7&distro=openSUSE%20Leap%2015.1 pkg:rpm/opensuse/php7&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/php7&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/php8&distro=openSUSE%20Tumbleweed pkg:rpm/suse/php5&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012 pkg:rpm/suse/php5&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3 pkg:rpm/suse/php5&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4 pkg:rpm/suse/php7&distro=SUSE%20Enterprise%20Storage%206 pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-ESPOS pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSS pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOS pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSS pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015 pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012 pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015 pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-BCL pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSS pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSS pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015 pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1 pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3 pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4 pkg:rpm/suse/php72&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012 pkg:rpm/suse/php72&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3 pkg:rpm/suse/php72&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4
< 5.1.12-2.module_el8.3.0+2010+7c76a223+ 60 more
- (no CPE)range: < 5.1.12-2.module_el8.3.0+2010+7c76a223
- (no CPE)range: < 1.5.1-2.module_el8.3.0+2010+7c76a223
- (no CPE)range: < 1.5.1-2.module_el8.4.0+2228+7c76a223
- (no CPE)range: < 1.5.1-2.module_el8.4.0+2228+7c76a223
- (no CPE)range: < 7.2.24-1.module_el8.3.0+2010+7c76a223
- (no CPE)range: < 7.2.24-1.module_el8.3.0+2010+7c76a223
- (no CPE)range: < 7.2.24-1.module_el8.4.0+2228+7c76a223
- (no CPE)range: < 7.2.24-1.module_el8.4.0+2228+7c76a223
- (no CPE)range: < 7.2.24-1.module_el8.4.0+2228+7c76a223
- (no CPE)range: < 7.2.24-1.module_el8.3.0+2010+7c76a223
- (no CPE)range: < 7.2.24-1.module_el8.3.0+2010+7c76a223
- (no CPE)range: < 7.2.24-1.module_el8.4.0+2228+7c76a223
- (no CPE)range: < 7.2.24-1.module_el8.4.0+2228+7c76a223
- (no CPE)range: < 7.2.24-1.module_el8.3.0+2010+7c76a223
- (no CPE)range: < 7.2.24-1.module_el8.5.0+53+9945c2af
- (no CPE)range: < 7.2.24-1.module_el8.4.0+2228+7c76a223
- (no CPE)range: < 7.2.24-1.module_el8.5.0+53+9945c2af
- (no CPE)range: < 7.2.24-1.module_el8.4.0+2228+7c76a223
- (no CPE)range: < 7.2.24-1.module_el8.3.0+2010+7c76a223
- (no CPE)range: < 7.2.24-1.module_el8.4.0+2228+7c76a223
- (no CPE)range: < 7.2.24-1.module_el8.3.0+2010+7c76a223
- (no CPE)range: < 7.2.24-1.module_el8.5.0+53+9945c2af
- (no CPE)range: < 7.2.24-1.module_el8.5.0+53+9945c2af
- (no CPE)range: < 7.2.24-1.module_el8.4.0+2228+7c76a223
- (no CPE)range: < 1:1.10.5-9.module_el8.3.0+2010+7c76a223
- (no CPE)range: < 5.1.12-2.module_el8.5.0+53+9945c2af
- (no CPE)range: < 5.1.12-2.module_el8.5.0+53+9945c2af
- (no CPE)range: < 1.15.3-1.module_el8.5.0+53+9945c2af
- (no CPE)range: < 7.2.24-1.module_el8.4.0+2228+7c76a223
- (no CPE)range: < 7.2.24-1.module_el8.5.0+53+9945c2af
- (no CPE)range: < 7.2.24-1.module_el8.5.0+53+9945c2af
- (no CPE)range: < 7.2.24-1.module_el8.3.0+2010+7c76a223
- (no CPE)range: < 7.2.24-1.module_el8.4.0+2228+7c76a223
- (no CPE)range: < 7.2.24-1.module_el8.4.0+2228+7c76a223
- (no CPE)range: < 7.2.24-1.module_el8.5.0+53+9945c2af
- (no CPE)range: < 7.2.5-lp150.2.19.1
- (no CPE)range: < 7.2.5-lp151.6.3.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.4.24-1.1
- (no CPE)range: < 8.0.11-1.1
- (no CPE)range: < 5.5.14-109.58.1
- (no CPE)range: < 5.5.14-109.58.1
- (no CPE)range: < 5.5.14-109.58.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.5-4.32.1
- (no CPE)range: < 7.0.7-50.75.1
- (no CPE)range: < 7.2.5-4.32.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.0.7-50.75.1
- (no CPE)range: < 7.0.7-50.75.1
- (no CPE)range: < 7.2.5-1.17.1
- (no CPE)range: < 7.2.5-1.17.1
- (no CPE)range: < 7.2.5-1.17.1

Patches

Vulnerability mechanics

References

lists.opensuse.org/opensuse-security-announce/2019-06/msg00010.htmlnvdMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2019-06/msg00012.htmlnvdMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.htmlnvdMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.htmlnvdMailing ListThird Party Advisory
www.securityfocus.com/bid/108177nvdThird Party AdvisoryVDB Entry
access.redhat.com/errata/RHSA-2019:2519nvdThird Party Advisory
access.redhat.com/errata/RHSA-2019:3299nvdThird Party Advisory
bugs.php.net/bug.phpnvdMailing ListVendor Advisory
lists.debian.org/debian-lts-announce/2019/05/msg00035.htmlnvdMailing ListThird Party Advisory
seclists.org/bugtraq/2019/Sep/35nvdMailing ListThird Party Advisory
seclists.org/bugtraq/2019/Sep/38nvdMailing ListThird Party Advisory
security.netapp.com/advisory/ntap-20190517-0003/nvdThird Party Advisory
usn.ubuntu.com/3566-2/nvdThird Party Advisory
usn.ubuntu.com/4009-1/nvdThird Party Advisory
www.debian.org/security/2019/dsa-4527nvdThird Party Advisory
www.debian.org/security/2019/dsa-4529nvdThird Party Advisory
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2NFXYNCXZCPYT7ZN4ZLI5EPQQW44FRRO/nvd
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3BY2XUUAN277LS7HKAOGL4DVGAELOJV3/nvd
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WN2HLPGEZEF4MFM5YC5FILZB5QEQFP3A/nvd

News mentions

No linked articles in our index yet.

cvss	0.591
epss	0.006
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000