High severity7.1NVD Advisory· Published Aug 9, 2019· Updated Jun 17, 2026

CVE-2019-11042

Description

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

PHP/PHP3 versions
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:php:php:*:*:*:*:*:*:*:*range: >=7.1.0,<7.1.31
- (no CPE)range: <7.1.31, <7.2.21, <7.3.8
- (no CPE)range: 7.1.x below 7.1.31
Red Hat/Software Collections
cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*
Tenable/Tenable.sc
cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:*
Range: <5.19.0
Apple Inc./Mac OS X
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
Range: <10.15.1
Canonical/Ubuntu Linux5 versions
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*+ 4 more
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*
Debian/linux3 versions
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
OpenSUSE/Leap
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
PHP/gd (PHP_GD2) extensionllm-fuzzy
Range: <7.1.31, <7.2.21, <7.3.8
osv-coords62 versions
pkg:rpm/almalinux/apcu-panel pkg:rpm/almalinux/libzip pkg:rpm/almalinux/libzip-devel pkg:rpm/almalinux/libzip-tools pkg:rpm/almalinux/php pkg:rpm/almalinux/php-bcmath pkg:rpm/almalinux/php-cli pkg:rpm/almalinux/php-common pkg:rpm/almalinux/php-dba pkg:rpm/almalinux/php-dbg pkg:rpm/almalinux/php-devel pkg:rpm/almalinux/php-embedded pkg:rpm/almalinux/php-enchant pkg:rpm/almalinux/php-fpm pkg:rpm/almalinux/php-gd pkg:rpm/almalinux/php-gmp pkg:rpm/almalinux/php-intl pkg:rpm/almalinux/php-json pkg:rpm/almalinux/php-ldap pkg:rpm/almalinux/php-mbstring pkg:rpm/almalinux/php-mysqlnd pkg:rpm/almalinux/php-odbc pkg:rpm/almalinux/php-opcache pkg:rpm/almalinux/php-pdo pkg:rpm/almalinux/php-pear pkg:rpm/almalinux/php-pecl-apcu pkg:rpm/almalinux/php-pecl-apcu-devel pkg:rpm/almalinux/php-pecl-rrd pkg:rpm/almalinux/php-pecl-xdebug pkg:rpm/almalinux/php-pecl-zip pkg:rpm/almalinux/php-pgsql pkg:rpm/almalinux/php-process pkg:rpm/almalinux/php-recode pkg:rpm/almalinux/php-snmp pkg:rpm/almalinux/php-soap pkg:rpm/almalinux/php-xml pkg:rpm/almalinux/php-xmlrpc pkg:rpm/opensuse/php7&distro=openSUSE%20Leap%2015.0 pkg:rpm/opensuse/php7&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/php7&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/php8&distro=openSUSE%20Tumbleweed pkg:rpm/suse/php5&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012 pkg:rpm/suse/php5&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4 pkg:rpm/suse/php53&distro=SUSE%20Linux%20Enterprise%20Point%20of%20Sale%2011%20SP3 pkg:rpm/suse/php53&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSS pkg:rpm/suse/php7&distro=SUSE%20Enterprise%20Storage%206 pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-ESPOS pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSS pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOS pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSS pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015 pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012 pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015 pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP1 pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-BCL pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSS pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSS pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015 pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1 pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4 pkg:rpm/suse/php72&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012 pkg:rpm/suse/php72&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4
< 5.1.12-2.module_el8.3.0+2010+7c76a223+ 61 more
- (no CPE)range: < 5.1.12-2.module_el8.3.0+2010+7c76a223
- (no CPE)range: < 1.5.1-2.module_el8.3.0+2010+7c76a223
- (no CPE)range: < 1.5.1-2.module_el8.4.0+2228+7c76a223
- (no CPE)range: < 1.5.1-2.module_el8.4.0+2228+7c76a223
- (no CPE)range: < 7.2.24-1.module_el8.3.0+2010+7c76a223
- (no CPE)range: < 7.2.24-1.module_el8.3.0+2010+7c76a223
- (no CPE)range: < 7.2.24-1.module_el8.4.0+2228+7c76a223
- (no CPE)range: < 7.2.24-1.module_el8.4.0+2228+7c76a223
- (no CPE)range: < 7.2.24-1.module_el8.4.0+2228+7c76a223
- (no CPE)range: < 7.2.24-1.module_el8.3.0+2010+7c76a223
- (no CPE)range: < 7.2.24-1.module_el8.3.0+2010+7c76a223
- (no CPE)range: < 7.2.24-1.module_el8.4.0+2228+7c76a223
- (no CPE)range: < 7.2.24-1.module_el8.4.0+2228+7c76a223
- (no CPE)range: < 7.2.24-1.module_el8.3.0+2010+7c76a223
- (no CPE)range: < 7.2.24-1.module_el8.5.0+53+9945c2af
- (no CPE)range: < 7.2.24-1.module_el8.4.0+2228+7c76a223
- (no CPE)range: < 7.2.24-1.module_el8.5.0+53+9945c2af
- (no CPE)range: < 7.2.24-1.module_el8.4.0+2228+7c76a223
- (no CPE)range: < 7.2.24-1.module_el8.3.0+2010+7c76a223
- (no CPE)range: < 7.2.24-1.module_el8.4.0+2228+7c76a223
- (no CPE)range: < 7.2.24-1.module_el8.3.0+2010+7c76a223
- (no CPE)range: < 7.2.24-1.module_el8.5.0+53+9945c2af
- (no CPE)range: < 7.2.24-1.module_el8.5.0+53+9945c2af
- (no CPE)range: < 7.2.24-1.module_el8.4.0+2228+7c76a223
- (no CPE)range: < 1:1.10.5-9.module_el8.3.0+2010+7c76a223
- (no CPE)range: < 5.1.12-2.module_el8.5.0+53+9945c2af
- (no CPE)range: < 5.1.12-2.module_el8.5.0+53+9945c2af
- (no CPE)range: < 2.0.1-1.module_el8.6.0+2750+78feabcb
- (no CPE)range: < 2.8.0-1.module_el8.5.0+152+112d3b8c
- (no CPE)range: < 1.15.3-1.module_el8.5.0+53+9945c2af
- (no CPE)range: < 7.2.24-1.module_el8.4.0+2228+7c76a223
- (no CPE)range: < 7.2.24-1.module_el8.5.0+53+9945c2af
- (no CPE)range: < 7.2.24-1.module_el8.5.0+53+9945c2af
- (no CPE)range: < 7.2.24-1.module_el8.3.0+2010+7c76a223
- (no CPE)range: < 7.2.24-1.module_el8.4.0+2228+7c76a223
- (no CPE)range: < 7.2.24-1.module_el8.4.0+2228+7c76a223
- (no CPE)range: < 7.2.24-1.module_el8.5.0+53+9945c2af
- (no CPE)range: < 7.2.5-lp150.2.25.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.4.24-1.1
- (no CPE)range: < 8.0.11-1.1
- (no CPE)range: < 5.5.14-109.68.1
- (no CPE)range: < 5.5.14-109.68.1
- (no CPE)range: < 5.3.17-112.71.1
- (no CPE)range: < 5.3.17-112.71.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.5-4.40.1
- (no CPE)range: < 7.0.7-50.85.1
- (no CPE)range: < 7.2.5-4.40.1
- (no CPE)range: < 7.2.5-4.40.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.0.7-50.85.1
- (no CPE)range: < 7.2.5-1.23.1
- (no CPE)range: < 7.2.5-1.23.1

Patches

Vulnerability mechanics

References

bugs.php.net/bug.phpnvdExploitPatchVendor Advisory
lists.opensuse.org/opensuse-security-announce/2019-10/msg00019.htmlnvdThird Party Advisory
seclists.org/fulldisclosure/2019/Oct/15nvdMailing ListThird Party Advisory
seclists.org/fulldisclosure/2019/Oct/55nvdMailing ListThird Party Advisory
access.redhat.com/errata/RHSA-2019:3299nvdThird Party Advisory
lists.debian.org/debian-lts-announce/2019/08/msg00010.htmlnvdMailing ListThird Party Advisory
seclists.org/bugtraq/2019/Oct/9nvdMailing ListThird Party Advisory
seclists.org/bugtraq/2019/Sep/35nvdMailing ListThird Party Advisory
seclists.org/bugtraq/2019/Sep/38nvdMailing ListThird Party Advisory
security.netapp.com/advisory/ntap-20190822-0003/nvdThird Party Advisory
support.apple.com/kb/HT210634nvdThird Party Advisory
support.apple.com/kb/HT210722nvdThird Party Advisory
usn.ubuntu.com/4097-1/nvdThird Party Advisory
usn.ubuntu.com/4097-2/nvdThird Party Advisory
www.debian.org/security/2019/dsa-4527nvdThird Party Advisory
www.debian.org/security/2019/dsa-4529nvdThird Party Advisory
www.tenable.com/security/tns-2021-14nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.461
epss	0.004
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000