Critical Buffer Overflow Vulnerability in PHP EXIF Extension - CVE-2019-11050
Summary
UBUNTU-CVE-2019-11050: When PHP EXIF extension is parsing EXIF information from an image, e.g. Affects php5 versions < 5.5.9+dfsg-1ubuntu4.29+esm8. Fixed in 5.5.9+dfsg-1ubuntu4.29+esm8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language designed for web development but also used as a general-purpose programming language. The PHP EXIF extension allows for the reading of EXIF headers from images, which is crucial for applications that handle image uploads and processing. However, certain versions of PHP have a vulnerability in the EXIF extension that can lead to buffer overflow issues, potentially exposing sensitive information or causing application crashes.
Vulnerability Detail
The vulnerability arises from the PHP EXIF extension's handling of EXIF data when using the exif_read_data() function. In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13, and 7.4.0, it is possible for an attacker to supply crafted data that causes the extension to read beyond the allocated buffer. This can lead to information disclosure, where sensitive data may be exposed, or application crashes, resulting in denial of service. The CVSS score for this vulnerability is 6.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
5.5.9+dfsg-1ubuntu4.29+esm8
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider disabling the EXIF extension temporarily until the update can be applied. This can be done by commenting out the extension in the php.ini file:
;extension=exif.so
After making changes, restart the web server to apply the configuration.
Conclusion
The CVE-2019-11050 vulnerability in the PHP EXIF extension poses a significant risk to applications that handle image data. It is crucial to update to the patched versions of PHP to ensure security and stability. Users are encouraged to utilize tools like Vulert for real-time monitoring of vulnerabilities.
See every vulnerability recorded for php5 →
FAQ
CVE-2019-11050 is a vulnerability in the PHP EXIF extension that allows for buffer overflow attacks, potentially leading to information disclosure or application crashes.
The vulnerability affects PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13, and 7.4.0.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring signup.
The consequences include the risk of sensitive data exposure and application crashes, which can lead to denial of service.
Yes, temporarily disabling the EXIF extension in the php.ini file can mitigate the risk until a proper update can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for php5.
