Bug 1788258 (CVE-2019-11050) - CVE-2019-11050 php: out-of-bounds read when parsing EXIF information
Summary: CVE-2019-11050 php: out-of-bounds read when parsing EXIF information
Status: NEW
Alias: CVE-2019-11050
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1790939 1790940 1790941 1790942 1788259 1790938
Blocks: 1788265
TreeView+ depends on / blocked
Reported: 2020-01-06 20:26 UTC by Guilherme de Almeida Suckevicz
Modified: 2020-01-14 15:22 UTC (History)
6 users (show)

Fixed In Version: php 7.3.14RC1, php 7.2.26
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed:

Attachments (Terms of Use)

Description Guilherme de Almeida Suckevicz 2020-01-06 20:26:28 UTC
When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.


Comment 1 Guilherme de Almeida Suckevicz 2020-01-06 20:26:46 UTC
Created php tracking bugs for this issue:

Affects: fedora-all [bug 1788259]

Comment 3 Marco Benatto 2020-01-14 15:12:37 UTC
Upstream commit for this issue: http://git.php.net/?p=php-src.git;a=commit;h=c14eb8de974fc8a4d74f3515424c293bc7a40fba

Comment 4 Marco Benatto 2020-01-14 15:18:15 UTC
There's an issue with EXIF module in PHP when exif tries to read maker notes from a given image metadata. When iterating on exif directories on exif_process_IFD_in_MAKERNOTE() starts to walk the buffer by the offset read but it doesn't decrement the remaining length of the buffer by the same proportion. An attack may leverage this issue by crafting an image with a malicious EXIF information, leading to Confidentiality impact and eventually DoS.

Both confidentiality and availability impact may be considered low. The attack has access just to a small amount of bytes from process heap and only a the single execution for this is affected.

Note You need to log in before you can comment on or make changes to this bug.