CVE catalog

CVE-2019-11041

Security update for php7

[CVE catalog]

Severity
High · CVSS 8.8CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
4.42% · Oct 25, 2026

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Ubuntuphp5pro5.5.3+dfsg-1ubuntu2vulnerable
Ubuntuphp5pro5.5.3+dfsg-1ubuntu3vulnerable
Ubuntuphp5pro5.5.6+dfsg-1ubuntu1vulnerable
Ubuntuphp5pro5.5.6+dfsg-1ubuntu2vulnerable
Ubuntuphp5pro5.5.8+dfsg-2ubuntu1vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu1vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu2vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu3vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.1vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.2vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.3vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.4vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.5vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.6vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.7vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.9vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.11vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.12vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.13vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.14vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.16vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.17vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.19vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.20vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.21vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.22vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.23vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.24vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.25vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.26vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.27vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm1vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm2vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm3vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm4vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm5fixed
Ubuntuphp7.016.047.0.1-5vulnerable
Ubuntuphp7.016.047.0.1-6vulnerable
Ubuntuphp7.016.047.0.2-1vulnerable
Ubuntuphp7.016.047.0.2-3vulnerable
Ubuntuphp7.016.047.0.2-4vulnerable
Ubuntuphp7.016.047.0.2-5vulnerable
Ubuntuphp7.016.047.0.3-2vulnerable
Ubuntuphp7.016.047.0.3-3vulnerable
Ubuntuphp7.016.047.0.3-9ubuntu1vulnerable
Ubuntuphp7.016.047.0.4-5ubuntu1vulnerable
Ubuntuphp7.016.047.0.4-5ubuntu2vulnerable
Ubuntuphp7.016.047.0.4-7ubuntu1vulnerable
Ubuntuphp7.016.047.0.4-7ubuntu2vulnerable
Ubuntuphp7.016.047.0.4-7ubuntu2.1vulnerable
Ubuntuphp7.016.047.0.8-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.8-0ubuntu0.16.04.2vulnerable
Ubuntuphp7.016.047.0.8-0ubuntu0.16.04.3vulnerable
Ubuntuphp7.016.047.0.13-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.15-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.15-0ubuntu0.16.04.2vulnerable
Ubuntuphp7.016.047.0.15-0ubuntu0.16.04.4vulnerable
Ubuntuphp7.016.047.0.18-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.22-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.25-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.28-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.30-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.32-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.2vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.3vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.4vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.5vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.6fixed
Ubuntuphp7.218.047.2.1-1ubuntu2vulnerable
Ubuntuphp7.218.047.2.2-1ubuntu1vulnerable
Ubuntuphp7.218.047.2.2-1ubuntu2vulnerable
Ubuntuphp7.218.047.2.3-1ubuntu1vulnerable
Ubuntuphp7.218.047.2.5-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.7-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.7-0ubuntu0.18.04.2vulnerable
Ubuntuphp7.218.047.2.10-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.15-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.15-0ubuntu0.18.04.2vulnerable
Ubuntuphp7.218.047.2.17-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.19-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.19-0ubuntu0.18.04.2fixed
Ubuntuphp7.016.047.0.1-5vulnerable
Ubuntuphp7.016.047.0.1-6vulnerable
Ubuntuphp7.016.047.0.2-1vulnerable
Ubuntuphp7.016.047.0.2-3vulnerable
Ubuntuphp7.016.047.0.2-4vulnerable
Ubuntuphp7.016.047.0.2-5vulnerable
Ubuntuphp7.016.047.0.3-2vulnerable
Ubuntuphp7.016.047.0.3-3vulnerable
Ubuntuphp7.016.047.0.3-9ubuntu1vulnerable
Ubuntuphp7.016.047.0.4-5ubuntu1vulnerable
Ubuntuphp7.016.047.0.4-5ubuntu2vulnerable
Ubuntuphp7.016.047.0.4-7ubuntu1vulnerable
Ubuntuphp7.016.047.0.4-7ubuntu2vulnerable
Ubuntuphp7.016.047.0.4-7ubuntu2.1vulnerable
Ubuntuphp7.016.047.0.8-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.8-0ubuntu0.16.04.2vulnerable
Ubuntuphp7.016.047.0.8-0ubuntu0.16.04.3vulnerable
Ubuntuphp7.016.047.0.13-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.15-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.15-0ubuntu0.16.04.2vulnerable
Ubuntuphp7.016.047.0.15-0ubuntu0.16.04.4vulnerable
Ubuntuphp7.016.047.0.18-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.22-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.25-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.28-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.30-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.32-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.2vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.3vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.4vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.5vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.6fixed
Ubuntuphp7.218.047.2.1-1ubuntu2vulnerable
Ubuntuphp7.218.047.2.2-1ubuntu1vulnerable
Ubuntuphp7.218.047.2.2-1ubuntu2vulnerable
Ubuntuphp7.218.047.2.3-1ubuntu1vulnerable
Ubuntuphp7.218.047.2.5-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.7-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.7-0ubuntu0.18.04.2vulnerable
Ubuntuphp7.218.047.2.10-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.15-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.15-0ubuntu0.18.04.2vulnerable
Ubuntuphp7.218.047.2.17-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.19-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.19-0ubuntu0.18.04.2fixed
Ubuntuphp5pro5.5.3+dfsg-1ubuntu2vulnerable
Ubuntuphp5pro5.5.3+dfsg-1ubuntu3vulnerable
Ubuntuphp5pro5.5.6+dfsg-1ubuntu1vulnerable
Ubuntuphp5pro5.5.6+dfsg-1ubuntu2vulnerable
Ubuntuphp5pro5.5.8+dfsg-2ubuntu1vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu1vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu2vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu3vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.1vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.2vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.3vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.4vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.5vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.6vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.7vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.9vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.11vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.12vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.13vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.14vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.16vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.17vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.19vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.20vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.21vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.22vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.23vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.24vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.25vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.26vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.27vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm1vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm2vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm3vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm4vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm5fixed
Debianphp585.6.11+dfsg-1vulnerable
Debianphp585.6.12+dfsg-0+deb8u1vulnerable
Debianphp585.6.12+dfsg-1vulnerable
Debianphp585.6.13+dfsg-0+deb8u1vulnerable
Debianphp585.6.13+dfsg-1vulnerable
Debianphp585.6.13+dfsg-2vulnerable
Debianphp585.6.14+dfsg-0+deb8u1vulnerable
Debianphp585.6.14+dfsg-1vulnerable
Debianphp585.6.15+dfsg-1vulnerable
Debianphp585.6.16+dfsg-1vulnerable
Debianphp585.6.16+dfsg-2vulnerable
Debianphp585.6.16+dfsg-3vulnerable
Debianphp585.6.16+dfsg-4vulnerable
Debianphp585.6.17+dfsg-0+deb8u1vulnerable
Debianphp585.6.17+dfsg-1vulnerable
Debianphp585.6.17+dfsg-3vulnerable
Debianphp585.6.18+dfsg-1vulnerable
Debianphp585.6.19+dfsg-0+deb8u1vulnerable
Debianphp585.6.19+dfsg-1vulnerable
Debianphp585.6.19+dfsg-2vulnerable
Debianphp585.6.20+dfsg-0+deb8u1vulnerable
Debianphp585.6.20+dfsg-1vulnerable
Debianphp585.6.21+dfsg-1vulnerable
Debianphp585.6.21+dfsg-2vulnerable
Debianphp585.6.22+dfsg-0+deb8u1vulnerable
Debianphp585.6.22+dfsg-1vulnerable
Debianphp585.6.22+dfsg-2vulnerable
Debianphp585.6.23+dfsg-0+deb8u1vulnerable
Debianphp585.6.23+dfsg-1vulnerable
Debianphp585.6.24+dfsg-0+deb8u1vulnerable
Debianphp585.6.24+dfsg-1vulnerable
Debianphp585.6.26+dfsg-0+deb8u1vulnerable
Debianphp585.6.26+dfsg-1vulnerable
Debianphp585.6.27+dfsg-0+deb8u1vulnerable
Debianphp585.6.28+dfsg-0+deb8u1vulnerable
Debianphp585.6.29+dfsg-0+deb8u1vulnerable
Debianphp585.6.30+dfsg-0+deb8u1vulnerable
Debianphp585.6.33+dfsg-0+deb8u1vulnerable
Debianphp585.6.36+dfsg-0+deb8u1vulnerable
Debianphp585.6.37+dfsg-0+deb8u1vulnerable
Debianphp585.6.38+dfsg-0+deb8u1vulnerable
Debianphp585.6.39+dfsg-0+deb8u1vulnerable
Debianphp585.6.39+dfsg-0+deb8u2vulnerable
Debianphp585.6.40+dfsg-0+deb8u1vulnerable
Debianphp585.6.40+dfsg-0+deb8u2vulnerable
Debianphp585.6.40+dfsg-0+deb8u3vulnerable
Debianphp585.6.40+dfsg-0+deb8u4vulnerable
Debianphp585.6.7+dfsg-1vulnerable
Debianphp585.6.9+dfsg-0+deb8u1vulnerable
Debianphp585.6.9+dfsg-1vulnerable
Debianphp585.6.40+dfsg-0+deb8u5fixed
Susephp72linux enterprise module for web and scripting 127.2.5-1.23.1fixed
Susephp72linux enterprise software development kit 12 sp47.2.5-1.23.1fixed
Opensusephp7leap 15.07.2.5-lp150.2.25.1fixed
Susephp5linux enterprise module for web and scripting 125.5.14-109.68.1fixed
Susephp5linux enterprise software development kit 12 sp45.5.14-109.68.1fixed
Susephp7linux enterprise module for package hub 157.2.5-4.40.1fixed
Susephp7linux enterprise module for web and scripting 157.2.5-4.40.1fixed
Susephp7linux enterprise module for web and scripting 15 sp17.2.5-4.40.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Ubuntuphp5debpro5.5.9+dfsg-1ubuntu4.29+esm5Not reportedUBUNTU-CVE-2019-11041Not reported
Ubuntuphp7.0deb16.047.0.33-0ubuntu0.16.04.6Not reportedUBUNTU-CVE-2019-11041Not reported
Ubuntuphp7.2deb18.047.2.19-0ubuntu0.18.04.2Not reportedUBUNTU-CVE-2019-11041Not reported
Ubuntuphp7.0deb16.047.0.33-0ubuntu0.16.04.6Not reportedUSN-4097-1Not reported
Ubuntuphp7.2deb18.047.2.19-0ubuntu0.18.04.2Not reportedUSN-4097-1Not reported
Ubuntuphp5debpro5.5.9+dfsg-1ubuntu4.29+esm5Not reportedUSN-4097-2Not reported
Debianphp5deb85.6.40+dfsg-0+deb8u5Not reportedDLA-1878-1Not reported
Susephp72rpmlinux enterprise module for web and scripting 127.2.5-1.23.1Not reportedSUSE-SU-2019:2270-1Not reported
Susephp72rpmlinux enterprise software development kit 12 sp47.2.5-1.23.1Not reportedSUSE-SU-2019:2270-1Not reported
Opensusephp7rpmleap 15.07.2.5-lp150.2.25.1Not reportedOPENSUSE-SU-2019:2271-1Not reported
Susephp5rpmlinux enterprise module for web and scripting 125.5.14-109.68.1Not reportedSUSE-SU-2020:0522-1Not reported
Susephp5rpmlinux enterprise software development kit 12 sp45.5.14-109.68.1Not reportedSUSE-SU-2020:0522-1Not reported
Susephp7rpmlinux enterprise module for package hub 157.2.5-4.40.1Not reportedSUSE-SU-2019:2503-1Not reported
Susephp7rpmlinux enterprise module for web and scripting 157.2.5-4.40.1Not reportedSUSE-SU-2019:2503-1Not reported
Susephp7rpmlinux enterprise module for web and scripting 15 sp17.2.5-4.40.1Not reportedSUSE-SU-2019:2503-1Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References