What’s Vulnerable › Vulnerabilities

CVE-2019-11039: Out-of-bounds read in iconv.c

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-06-19 · updated 2026-06-17
• Weakness: CWE-125

Description

Function iconv_mime_decode_headers() in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 may perform out-of-buffer read due to integer overflow when parsing MIME headers. This may lead to information disclosure or crash.

Affected products

• Debian Linux: 9.0, 10.0
• openSUSE Leap: 15.0, 15.1
• PHP: from 7.1.0 before 7.1.30; from 7.2.0 before 7.2.19; from 7.3.0 before 7.3.6 — fixed in 7.1.30, 7.2.19, 7.3.6
• RedHat Software Collections: 1.0

How to fix

Upgrade to a fixed version: PHP 7.1.30, 7.2.19, 7.3.6. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00029.html
• https://access.redhat.com/errata/RHSA-2019:2519
• https://access.redhat.com/errata/RHSA-2019:3299
• https://bugs.php.net/bug.php?id=78069
• https://seclists.org/bugtraq/2019/Sep/35
• https://seclists.org/bugtraq/2019/Sep/38
• https://www.debian.org/security/2019/dsa-4527
• https://www.debian.org/security/2019/dsa-4529
• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00029.html
• https://access.redhat.com/errata/RHSA-2019:2519
• https://access.redhat.com/errata/RHSA-2019:3299
• https://bugs.php.net/bug.php?id=78069

Get alerted when CVE-2019-11039 or the next vulnerability affects your stack