CVE catalog

CVE-2019-11042

UBUNTU-CVE-2019-11042

[CVE catalog]

Severity
Medium · CVSS 5.4CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Published
Updated
Source
[NVD] · [CVE record]
EPSS
4.42% · Oct 25, 2026

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Ubuntuphp5pro5.5.3+dfsg-1ubuntu2vulnerable
Ubuntuphp5pro5.5.3+dfsg-1ubuntu3vulnerable
Ubuntuphp5pro5.5.6+dfsg-1ubuntu1vulnerable
Ubuntuphp5pro5.5.6+dfsg-1ubuntu2vulnerable
Ubuntuphp5pro5.5.8+dfsg-2ubuntu1vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu1vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu2vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu3vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.1vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.2vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.3vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.4vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.5vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.6vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.7vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.9vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.11vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.12vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.13vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.14vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.16vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.17vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.19vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.20vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.21vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.22vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.23vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.24vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.25vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.26vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.27vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm1vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm2vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm3vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm4vulnerable
Ubuntuphp5pro5.5.9+dfsg-1ubuntu4.29+esm5fixed
Ubuntuphp7.016.047.0.1-5vulnerable
Ubuntuphp7.016.047.0.1-6vulnerable
Ubuntuphp7.016.047.0.2-1vulnerable
Ubuntuphp7.016.047.0.2-3vulnerable
Ubuntuphp7.016.047.0.2-4vulnerable
Ubuntuphp7.016.047.0.2-5vulnerable
Ubuntuphp7.016.047.0.3-2vulnerable
Ubuntuphp7.016.047.0.3-3vulnerable
Ubuntuphp7.016.047.0.3-9ubuntu1vulnerable
Ubuntuphp7.016.047.0.4-5ubuntu1vulnerable
Ubuntuphp7.016.047.0.4-5ubuntu2vulnerable
Ubuntuphp7.016.047.0.4-7ubuntu1vulnerable
Ubuntuphp7.016.047.0.4-7ubuntu2vulnerable
Ubuntuphp7.016.047.0.4-7ubuntu2.1vulnerable
Ubuntuphp7.016.047.0.8-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.8-0ubuntu0.16.04.2vulnerable
Ubuntuphp7.016.047.0.8-0ubuntu0.16.04.3vulnerable
Ubuntuphp7.016.047.0.13-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.15-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.15-0ubuntu0.16.04.2vulnerable
Ubuntuphp7.016.047.0.15-0ubuntu0.16.04.4vulnerable
Ubuntuphp7.016.047.0.18-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.22-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.25-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.28-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.30-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.32-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.2vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.3vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.4vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.5vulnerable
Ubuntuphp7.016.047.0.33-0ubuntu0.16.04.6fixed
Ubuntuphp7.218.047.2.1-1ubuntu2vulnerable
Ubuntuphp7.218.047.2.2-1ubuntu1vulnerable
Ubuntuphp7.218.047.2.2-1ubuntu2vulnerable
Ubuntuphp7.218.047.2.3-1ubuntu1vulnerable
Ubuntuphp7.218.047.2.5-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.7-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.7-0ubuntu0.18.04.2vulnerable
Ubuntuphp7.218.047.2.10-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.15-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.15-0ubuntu0.18.04.2vulnerable
Ubuntuphp7.218.047.2.17-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.19-0ubuntu0.18.04.1vulnerable
Ubuntuphp7.218.047.2.19-0ubuntu0.18.04.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Ubuntuphp5debpro5.5.9+dfsg-1ubuntu4.29+esm5Not reportedUBUNTU-CVE-2019-11042Not reported
Ubuntuphp7.0deb16.047.0.33-0ubuntu0.16.04.6Not reportedUBUNTU-CVE-2019-11042Not reported
Ubuntuphp7.2deb18.047.2.19-0ubuntu0.18.04.2Not reportedUBUNTU-CVE-2019-11042Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]