Bug 1724154 (CVE-2019-11040)

Summary:	CVE-2019-11040 php: Buffer over-read in exif_read_data()
Product:	[Other] Security Response	Reporter:	Dhananjay Arunesh <darunesh>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	fedora, hhorak, jorton, rcollet, webstack-team, yozone
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	php 7.1.30, php 7.2.19, php 7.3.6	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-08-19 08:48:11 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1724156, 1726662, 1726663, 1726664, 1726665, 1726666, 1772835, 1857696
Bug Blocks:	1724158

Description Dhananjay Arunesh 2019-06-26 11:10:44 UTC

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.

Reference:
https://bugs.php.net/bug.php?id=77988

Comment 1 Dhananjay Arunesh 2019-06-26 11:12:34 UTC

Created php tracking bugs for this issue:

Affects: fedora-all [bug 1724156]

Comment 2 Riccardo Schirone 2019-07-03 09:17:06 UTC

Upstream patches:
http://git.php.net/?p=php-src.git;a=commit;h=73ff4193be24192c894dc0502d06e2b2db35eefb
http://git.php.net/?p=php-src.git;a=commit;h=b7dc3d9039335b2bfaa1f4ade5d38aec89f25922

Comment 6 errata-xmlrpc 2019-08-19 08:43:03 UTC

This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS

Via RHSA-2019:2519 https://access.redhat.com/errata/RHSA-2019:2519

Comment 7 Product Security DevOps Team 2019-08-19 08:48:11 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-11040

Comment 8 errata-xmlrpc 2019-11-01 13:01:07 UTC

This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

Via RHSA-2019:3299 https://access.redhat.com/errata/RHSA-2019:3299

Comment 10 errata-xmlrpc 2020-04-28 15:31:59 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:1624 https://access.redhat.com/errata/RHSA-2020:1624

Comment 12 errata-xmlrpc 2020-09-08 09:45:46 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:3662 https://access.redhat.com/errata/RHSA-2020:3662