Medium severity4.8NVD Advisory· Published Dec 23, 2019· Updated Jun 17, 2026

CVE-2019-11050

Description

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

PHP/PHP4 versions
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:php:php:*:*:*:*:*:*:*:*range: >=7.2.0,<=7.2.26
- cpe:2.3:a:php:php:7.4.0:*:*:*:*:*:*:*
- (no CPE)range: <7.2.26, <7.3.13, 7.4.0
- (no CPE)range: 7.2.x
Tenable/Securitycenter
cpe:2.3:a:tenable:securitycenter:*:*:*:*:*:*:*:*
Range: <5.19.0
Canonical/Ubuntu Linux5 versions
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*+ 4 more
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*
Debian/linux3 versions
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Fedoraproject/Fedora2 versions
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
OpenSUSE/Leap
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
PHP/gd (PHP_GD2) extensionllm-fuzzy
Range: <7.2.26, <7.3.13, 7.4.0
osv-coords63 versions
pkg:rpm/almalinux/apcu-panel pkg:rpm/almalinux/libzip pkg:rpm/almalinux/libzip-devel pkg:rpm/almalinux/libzip-tools pkg:rpm/almalinux/php pkg:rpm/almalinux/php-bcmath pkg:rpm/almalinux/php-cli pkg:rpm/almalinux/php-common pkg:rpm/almalinux/php-dba pkg:rpm/almalinux/php-dbg pkg:rpm/almalinux/php-devel pkg:rpm/almalinux/php-embedded pkg:rpm/almalinux/php-enchant pkg:rpm/almalinux/php-fpm pkg:rpm/almalinux/php-gd pkg:rpm/almalinux/php-gmp pkg:rpm/almalinux/php-intl pkg:rpm/almalinux/php-json pkg:rpm/almalinux/php-ldap pkg:rpm/almalinux/php-mbstring pkg:rpm/almalinux/php-mysqlnd pkg:rpm/almalinux/php-odbc pkg:rpm/almalinux/php-opcache pkg:rpm/almalinux/php-pdo pkg:rpm/almalinux/php-pear pkg:rpm/almalinux/php-pecl-apcu pkg:rpm/almalinux/php-pecl-apcu-devel pkg:rpm/almalinux/php-pecl-rrd pkg:rpm/almalinux/php-pecl-xdebug pkg:rpm/almalinux/php-pecl-zip pkg:rpm/almalinux/php-pgsql pkg:rpm/almalinux/php-process pkg:rpm/almalinux/php-recode pkg:rpm/almalinux/php-snmp pkg:rpm/almalinux/php-soap pkg:rpm/almalinux/php-xml pkg:rpm/almalinux/php-xmlrpc pkg:rpm/opensuse/php7&distro=openSUSE%20Leap%2015.1 pkg:rpm/opensuse/php7&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/php7-test&distro=openSUSE%20Leap%2015.1 pkg:rpm/suse/php5&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012 pkg:rpm/suse/php5&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4 pkg:rpm/suse/php53&distro=SUSE%20Linux%20Enterprise%20Point%20of%20Sale%2011%20SP3 pkg:rpm/suse/php53&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSS pkg:rpm/suse/php7&distro=SUSE%20Enterprise%20Storage%206 pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-ESPOS pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSS pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOS pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSS pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015 pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012 pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015 pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP1 pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-BCL pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSS pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSS pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015 pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1 pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4 pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5 pkg:rpm/suse/php72&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012 pkg:rpm/suse/php72&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4 pkg:rpm/suse/php72&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5
< 5.1.17-1.module_el8.3.0+2009+b272fdef+ 62 more
- (no CPE)range: < 5.1.17-1.module_el8.3.0+2009+b272fdef
- (no CPE)range: < 1.5.2-1.module_el8.5.0+152+112d3b8c
- (no CPE)range: < 1.5.2-1.module_el8.4.0+2229+b272fdef
- (no CPE)range: < 1.5.2-1.module_el8.5.0+152+112d3b8c
- (no CPE)range: < 7.3.20-1.module_el8.4.0+2229+b272fdef
- (no CPE)range: < 7.3.20-1.module_el8.4.0+2229+b272fdef
- (no CPE)range: < 7.3.20-1.module_el8.5.0+152+112d3b8c
- (no CPE)range: < 7.3.20-1.module_el8.3.0+2009+b272fdef
- (no CPE)range: < 7.3.20-1.module_el8.5.0+152+112d3b8c
- (no CPE)range: < 7.3.20-1.module_el8.3.0+2009+b272fdef
- (no CPE)range: < 7.3.20-1.module_el8.4.0+2229+b272fdef
- (no CPE)range: < 7.3.20-1.module_el8.3.0+2009+b272fdef
- (no CPE)range: < 7.3.20-1.module_el8.4.0+2229+b272fdef
- (no CPE)range: < 7.3.20-1.module_el8.5.0+152+112d3b8c
- (no CPE)range: < 7.3.20-1.module_el8.4.0+2229+b272fdef
- (no CPE)range: < 7.3.20-1.module_el8.3.0+2009+b272fdef
- (no CPE)range: < 7.3.20-1.module_el8.5.0+152+112d3b8c
- (no CPE)range: < 7.3.20-1.module_el8.3.0+2009+b272fdef
- (no CPE)range: < 7.3.20-1.module_el8.5.0+152+112d3b8c
- (no CPE)range: < 7.3.20-1.module_el8.5.0+152+112d3b8c
- (no CPE)range: < 7.3.20-1.module_el8.4.0+2229+b272fdef
- (no CPE)range: < 7.3.20-1.module_el8.3.0+2009+b272fdef
- (no CPE)range: < 7.3.20-1.module_el8.5.0+152+112d3b8c
- (no CPE)range: < 7.3.20-1.module_el8.5.0+152+112d3b8c
- (no CPE)range: < 1:1.10.9-1.module_el8.3.0+2009+b272fdef
- (no CPE)range: < 5.1.17-1.module_el8.5.0+152+112d3b8c
- (no CPE)range: < 5.1.17-1.module_el8.3.0+2009+b272fdef
- (no CPE)range: < 2.0.1-1.module_el8.6.0+2750+78feabcb
- (no CPE)range: < 2.8.0-1.module_el8.5.0+152+112d3b8c
- (no CPE)range: < 1.15.4-1.module_el8.4.0+2229+b272fdef
- (no CPE)range: < 7.3.20-1.module_el8.5.0+152+112d3b8c
- (no CPE)range: < 7.3.20-1.module_el8.4.0+2229+b272fdef
- (no CPE)range: < 7.3.20-1.module_el8.5.0+152+112d3b8c
- (no CPE)range: < 7.3.20-1.module_el8.3.0+2009+b272fdef
- (no CPE)range: < 7.3.20-1.module_el8.4.0+2229+b272fdef
- (no CPE)range: < 7.3.20-1.module_el8.4.0+2229+b272fdef
- (no CPE)range: < 7.3.20-1.module_el8.5.0+152+112d3b8c
- (no CPE)range: < 7.2.5-lp151.6.19.2
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.5-lp151.6.19.2
- (no CPE)range: < 5.5.14-109.68.1
- (no CPE)range: < 5.5.14-109.68.1
- (no CPE)range: < 5.3.17-112.79.1
- (no CPE)range: < 5.3.17-112.79.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.5-4.49.1
- (no CPE)range: < 7.0.7-50.91.1
- (no CPE)range: < 7.2.5-4.49.1
- (no CPE)range: < 7.2.5-4.49.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.0.7-50.91.1
- (no CPE)range: < 7.0.7-50.91.1
- (no CPE)range: < 7.2.5-1.32.1
- (no CPE)range: < 7.2.5-1.32.1
- (no CPE)range: < 7.2.5-1.32.1

Patches

Vulnerability mechanics

References

bugs.php.net/bug.phpnvdExploitMailing ListPatchVendor Advisory
lists.opensuse.org/opensuse-security-announce/2020-01/msg00036.htmlnvdMailing ListThird Party Advisory
lists.debian.org/debian-lts-announce/2019/12/msg00034.htmlnvdMailing ListThird Party Advisory
seclists.org/bugtraq/2020/Feb/27nvdMailing ListThird Party Advisory
seclists.org/bugtraq/2020/Feb/31nvdMailing ListThird Party Advisory
seclists.org/bugtraq/2021/Jan/3nvdMailing ListThird Party Advisory
security.netapp.com/advisory/ntap-20200103-0002/nvdThird Party Advisory
usn.ubuntu.com/4239-1/nvdThird Party Advisory
www.debian.org/security/2020/dsa-4626nvdThird Party Advisory
www.debian.org/security/2020/dsa-4628nvdThird Party Advisory
www.tenable.com/security/tns-2021-14nvdThird Party Advisory
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/nvd
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/nvd

News mentions

No linked articles in our index yet.

cvss	0.312
epss	0.006
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000