What’s Vulnerable › Vulnerabilities

CVE-2019-11034: Heap over-read in PHP EXIF extension

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-04-18 · updated 2026-06-17
• Weakness: CWE-125

Description

When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash.

Affected products

• Canonical Ubuntu Linux: 12.04, 14.04, 16.04, 18.04, 18.10, 19.04
• Debian Linux: 8.0, 9.0
• NetApp Storage Automation Store: all versions
• openSUSE Leap: 15.0, 15.1, 42.3
• PHP: from 7.1.0 before 7.1.28; from 7.2.9 before 7.2.17; from 7.3.0 before 7.3.4 — fixed in 7.1.28, 7.2.17, 7.3.4
• RedHat Software Collections: 1.0

How to fix

Upgrade to a fixed version: PHP 7.1.28, 7.2.17, 7.3.4. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00010.html
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00012.html
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html
• https://access.redhat.com/errata/RHSA-2019:2519
• https://access.redhat.com/errata/RHSA-2019:3299
• https://bugs.php.net/bug.php?id=77753
• https://lists.debian.org/debian-lts-announce/2019/05/msg00035.html
• https://seclists.org/bugtraq/2019/Sep/38
• https://security.netapp.com/advisory/ntap-20190502-0001/
• https://support.f5.com/csp/article/K44590877
• https://usn.ubuntu.com/3953-1/

Get alerted when CVE-2019-11034 or the next vulnerability affects your stack