PHP 'ext/exif/exif.c' Heap Buffer Overflow Vulnerability

Bugtraq ID:	108177
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2019-11036
Remote:	Yes
Local:	No
Published:	Apr 29 2019 12:00AM
Updated:	Apr 29 2019 12:00AM
Credit:	Stanislav Malyshev
Vulnerable:	PHP PHP 7.3.4 PHP PHP 7.3.3 PHP PHP 7.3.2 PHP PHP 7.3.1 PHP PHP 7.3 PHP PHP 7.2.17 PHP PHP 7.2.16 PHP PHP 7.2.14 PHP PHP 7.2.13 PHP PHP 7.2.12 PHP PHP 7.2.8 PHP PHP 7.2.7 PHP PHP 7.2.6 PHP PHP 7.2.5 PHP PHP 7.2.4 PHP PHP 7.2.3 PHP PHP 7.2.2 PHP PHP 7.2.1 PHP PHP 7.2 PHP PHP 7.1.28 PHP PHP 7.1.27 PHP PHP 7.1.26 PHP PHP 7.1.25 PHP PHP 7.1.24 PHP PHP 7.1.20 PHP PHP 7.1.17 PHP PHP 7.1.16 PHP PHP 7.1.13 PHP PHP 7.1.12 PHP PHP 7.1.11 PHP PHP 7.1.9 PHP PHP 7.1.8 PHP PHP 7.1.7 PHP PHP 7.1.6 PHP PHP 7.1.5 PHP PHP 7.1.4 PHP PHP 7.1.1 PHP PHP 7.1 PHP PHP 7.1.3 PHP PHP 7.1.2 PHP PHP 7.1.14
Not Vulnerable:	PHP PHP 7.3.5 PHP PHP 7.2.18 PHP PHP 7.1.29

PHP 'ext/exif/exif.c' Heap Buffer Overflow Vulnerability

PHP is prone to a heap-based buffer-overflow vulnerability.

Successfully exploiting this issue allow attackers to execute arbitrary code in the context of the affected application. Failed exploits will result in denial-of-service conditions.

PHP 7.1.x versions prior to 7.1.29, 7.2.x versions prior to 7.2.18 and 7.3.x versions prior to 7.3. are vulnerable.

PHP 'ext/exif/exif.c' Heap Buffer Overflow Vulnerability

The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.

PHP 'ext/exif/exif.c' Heap Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

PHP 'ext/exif/exif.c' Heap Buffer Overflow Vulnerability

References:

• Fix bug #77950 - Heap-buffer-overflow in _estrndup via exif_process_IFD_TAG PHP- (PHP)
  
• PHP Homepage (PHP)
  
• Heap-buffer-overflow in _estrndup via exif_process_IFD_TAG (PHP)