Critical Buffer Overflow Vulnerability in PHP EXIF Extension - CVE-2019-11042
Summary
UBUNTU-CVE-2019-11042: When PHP EXIF extension is parsing EXIF information from an image, e.g. Affects php5 versions < 5.5.9+dfsg-1ubuntu4.29+esm5. Fixed in 5.5.9+dfsg-1ubuntu4.29+esm5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language designed for web development but also used as a general-purpose programming language. The PHP EXIF extension allows for the reading of metadata from images, particularly useful for handling JPEG files. This extension is integral for applications that manipulate image data, providing functionalities to extract information such as camera settings and image orientation. However, certain versions of PHP are vulnerable to a buffer overflow issue in the EXIF extension, which can lead to severe security risks.
Vulnerability Detail
The vulnerability, identified as CVE-2019-11042, arises when the PHP EXIF extension processes EXIF data from images using the exif_read_data() function. In PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21, and 7.3.x below 7.3.8, it is possible to supply crafted data that causes the extension to read beyond the allocated buffer. This can lead to information disclosure, allowing attackers to access sensitive data, or even cause the application to crash, resulting in denial of service. The vulnerability has a CVSS score of 7.1, indicating a high severity level.
How To Fix
Minimum fixed version
5.5.9+dfsg-1ubuntu4.29+esm5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider disabling the EXIF extension temporarily until the update can be applied. This can be done by commenting out the extension in the php.ini file:
;extension=exif.so
After making changes, restart the web server to apply the configuration.
Conclusion
CVE-2019-11042 is a critical vulnerability in the PHP EXIF extension that poses significant risks to applications using affected PHP versions. Immediate action is recommended to update to the patched versions to mitigate potential security threats.
See every vulnerability recorded for php5 →
FAQ
CVE-2019-11042 is a vulnerability in the PHP EXIF extension that allows for buffer overflow, potentially leading to information disclosure or application crashes.
The vulnerability affects PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21, and 7.3.x below 7.3.8.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized access to sensitive information or cause the application to crash, resulting in denial of service.
If you cannot update immediately, consider disabling the EXIF extension in your PHP configuration as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for php5.
