heap-buffer-overflow on exif_scan_thumbnail Upstream issue and patch: https://bugs.php.net/bug.php?id=78222
Created php tracking bugs for this issue: Affects: fedora-all [bug 1739464]
Upstream commit: http://git.php.net/?p=php-src.git;a=commitdiff;h=f22101c8308669bb63c03a73a2cac2408d844f38 Upstream bug as well as the fix indicate short buffer over-read, that is unlikely to have any visible impact without using using tools as valgrind or AddressSanitizer.
PHP's exif module is responsible to extract exif information from images. One possible information contained in EXIF header are the possible thumbnails for the image itself. When parsing EXIF information the exif module allocate a buffer at exif_thumbnail_extract() to hold the Thumbnail image, this buffer's size is based on the Thumbnail size metadata present on the image. When the image has invalid thumbnail size it leads exif module to a heap-based buffer overflow on function exif_scan_thumbnail(). The overflow happens when exif_scan_thumbnail() tries to verify the JPEG magic number present in the Thumbnail image, which is 3-bytes long, but the thumbnail size contained at EXIF header is smaller than this value. An attacker may leverage this flaw by using a crafted image to cause unexpected heap based data read, causing a low confidentiality impact.
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS Via RHSA-2019:3299 https://access.redhat.com/errata/RHSA-2019:3299
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-11041
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:1624 https://access.redhat.com/errata/RHSA-2020:1624
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:3662 https://access.redhat.com/errata/RHSA-2020:3662