What’s Vulnerable › Vulnerabilities

CVE-2019-11035: Heap over-read in PHP EXIF extension

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-04-18 · updated 2026-06-17
• Weakness: CWE-125

Description

When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_iif_add_value function. This may lead to information disclosure or crash.

Affected products

• Canonical Ubuntu Linux: 12.04, 14.04, 16.04, 18.04, 18.10, 19.04
• Debian Linux: 8.0, 9.0
• NetApp Storage Automation Store: all versions
• openSUSE Leap: 15.0, 15.1, 42.3
• PHP: from 7.1.0 before 7.1.28; from 7.2.9 before 7.2.17; from 7.3.0 before 7.3.4 — fixed in 7.1.28, 7.2.17, 7.3.4
• RedHat Software Collections: 1.0

How to fix

Upgrade to a fixed version: PHP 7.1.28, 7.2.17, 7.3.4. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00010.html
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00012.html
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html
• https://access.redhat.com/errata/RHSA-2019:2519
• https://access.redhat.com/errata/RHSA-2019:3299
• https://bugs.php.net/bug.php?id=77831
• https://lists.debian.org/debian-lts-announce/2019/05/msg00035.html
• https://seclists.org/bugtraq/2019/Sep/38
• https://security.netapp.com/advisory/ntap-20190502-0001/
• https://support.f5.com/csp/article/K44590877
• https://usn.ubuntu.com/3953-1/

Get alerted when CVE-2019-11035 or the next vulnerability affects your stack