What’s Vulnerable › Vulnerabilities
CVE-2019-11046: Buffer underflow in bc_shift_addsub
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 4.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2019-12-23 · updated 2026-08-17
- Weakness: CWE-125
Description
In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, including Windows, can be tricked into reading beyond the allocated space by supplying it with string containing characters that are identified as numeric by the OS but aren't ASCII numbers. This can read to disclosure of the content of some memory locations.
Affected products
- Canonical Ubuntu Linux: 12.04, 14.04, 16.04, 18.04, 19.04, 19.10
- Debian Linux: 8.0, 9.0, 10.0
- Fedoraproject Fedora: 30, 31
- openSUSE Leap: 15.1
- PHP: from 7.2.0 through 7.2.26; from 7.3.0 through 7.3.13; 7.4.0
- Tenable, Inc. Security Center: before 5.19.0 — fixed in 5.19.0
How to fix
Upgrade to a fixed version: Tenable, Inc. Security Center 5.19.0. Check the vendor advisory for mitigations.
References
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00036.html
- https://bugs.php.net/bug.php?id=78878
- https://lists.debian.org/debian-lts-announce/2019/12/msg00034.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/
- https://seclists.org/bugtraq/2020/Feb/27
- https://seclists.org/bugtraq/2020/Feb/31
- https://seclists.org/bugtraq/2021/Jan/3
- https://security.netapp.com/advisory/ntap-20200103-0002/
- https://support.f5.com/csp/article/K48866433?utm_source=f5support&%3Butm_medium=RSS
- https://usn.ubuntu.com/4239-1/
- https://www.debian.org/security/2020/dsa-4626
Get alerted when CVE-2019-11046 or the next vulnerability affects your stack