CVE catalog

CVE-2019-11035

UBUNTU-CVE-2019-11035

[CVE catalog]

Severity
Medium · CVSS 6.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Published
Updated
Source
[NVD] · [CVE record]
EPSS
4.41% · Oct 25, 2026

When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_iif_add_value function. This may lead to information disclosure or crash.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Ubuntuphp5pro5.5.3+dfsg-1ubuntu2vulnerable
Ubuntuphp5pro5.5.3+dfsg-1ubuntu3vulnerable
Ubuntuphp5pro5.5.6+dfsg-1ubuntu1vulnerable
Ubuntuphp5pro5.5.6+dfsg-1ubuntu2vulnerable
Ubuntuphp5pro5.5.8+dfsg-2ubuntu1vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu1vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu2vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu3vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.1vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.2vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.3vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.4vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.5vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.6vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.7vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.9vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.11vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.12vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.13vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.14vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.16vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.17vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.19vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.20vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.21vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.22vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.23vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.24vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.25vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.26vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.27vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm1fixed
Ubuntuphp7.016.047.0.1-5vulnerable
Ubuntuphp7.016.047.0.1-6vulnerable
Ubuntuphp7.016.047.0.2-1vulnerable
Ubuntuphp7.016.047.0.2-3vulnerable
Ubuntuphp7.016.047.0.2-4vulnerable
Ubuntuphp7.016.047.0.2-5vulnerable
Ubuntuphp7.016.047.0.3-2vulnerable
Ubuntuphp7.016.047.0.3-3vulnerable
Ubuntuphp7.016.047.0.3-9ubuntu1vulnerable
Ubuntuphp7.016.047.0.4-5ubuntu1vulnerable
Ubuntuphp7.016.047.0.4-5ubuntu2vulnerable
Ubuntuphp7.016.047.0.4-7ubuntu1vulnerable
Ubuntuphp7.016.047.0.4-7ubuntu2vulnerable
Ubuntuphp7.016.047.0.4-7ubuntu2.1vulnerable
Ubuntuphp7.016.047.0.8-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.8-0ubuntu0.16.04.2vulnerable
Ubuntuphp7.016.047.0.8-0ubuntu0.16.04.3vulnerable
Ubuntuphp7.016.047.0.13-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.15-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.15-0ubuntu0.16.04.2vulnerable
Ubuntuphp7.016.047.0.15-0ubuntu0.16.04.4vulnerable
Ubuntuphp7.016.047.0.18-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.22-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.25-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.28-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.30-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.32-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.2vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.3vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.4fixed
Ubuntuphp7.218.047.2.1-1ubuntu2vulnerable
Ubuntuphp7.218.047.2.2-1ubuntu1vulnerable
Ubuntuphp7.218.047.2.2-1ubuntu2vulnerable
Ubuntuphp7.218.047.2.3-1ubuntu1vulnerable
Ubuntuphp7.218.047.2.5-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.7-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.7-0ubuntu0.18.04.2vulnerable
Ubuntuphp7.218.047.2.10-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.15-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.15-0ubuntu0.18.04.2vulnerable
Ubuntuphp7.218.047.2.17-0ubuntu0.18.04.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Ubuntuphp5debpro5.5.9+dfsg-1ubuntu4.29+esm1Not reportedUBUNTU-CVE-2019-11035Not reported
Ubuntuphp7.0deb16.047.0.33-0ubuntu0.16.04.4Not reportedUBUNTU-CVE-2019-11035Not reported
Ubuntuphp7.2deb18.047.2.17-0ubuntu0.18.04.1Not reportedUBUNTU-CVE-2019-11035Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]