Lucene search
AmazonALAS-2019-1240HistoryJul 17, 2019 - 11:33 p.m.
Medium: php71, php72, php73
2019-07-1723:33:00
alas.aws.amazon.com
112
9.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
6.4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:N/A:P
0.007 Low
EPSS
Percentile
80.0%
Issue Overview:
Function iconv_mime_decode_headers() in PHP may perform out-of-buffer read due to integer overflow when parsing MIME headers. This may lead to information disclosure or crash.(CVE-2019-11039)
When using gdImageCreateFromXbm() function of PHP gd extension, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been left there by previous code. (CVE-2019-11038)
When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash. (CVE-2019-11040)
Affected Packages:
php71, php72, php73
Issue Correction:
Run yum update php71 to update your system.
Run yum update php72 to update your system.
Run yum update php73 to update your system.
New Packages:
i686:
php73-fpm-7.3.6-1.17.amzn1.i686
php73-gd-7.3.6-1.17.amzn1.i686
php73-bcmath-7.3.6-1.17.amzn1.i686
php73-mysqlnd-7.3.6-1.17.amzn1.i686
php73-common-7.3.6-1.17.amzn1.i686
php73-cli-7.3.6-1.17.amzn1.i686
php73-tidy-7.3.6-1.17.amzn1.i686
php73-odbc-7.3.6-1.17.amzn1.i686
php73-json-7.3.6-1.17.amzn1.i686
php73-xmlrpc-7.3.6-1.17.amzn1.i686
php73-pgsql-7.3.6-1.17.amzn1.i686
php73-intl-7.3.6-1.17.amzn1.i686
php73-mbstring-7.3.6-1.17.amzn1.i686
php73-pdo-7.3.6-1.17.amzn1.i686
php73-imap-7.3.6-1.17.amzn1.i686
php73-debuginfo-7.3.6-1.17.amzn1.i686
php73-gmp-7.3.6-1.17.amzn1.i686
php73-dbg-7.3.6-1.17.amzn1.i686
php73-embedded-7.3.6-1.17.amzn1.i686
php73-opcache-7.3.6-1.17.amzn1.i686
php73-dba-7.3.6-1.17.amzn1.i686
php73-xml-7.3.6-1.17.amzn1.i686
php73-process-7.3.6-1.17.amzn1.i686
php73-devel-7.3.6-1.17.amzn1.i686
php73-7.3.6-1.17.amzn1.i686
php73-enchant-7.3.6-1.17.amzn1.i686
php73-soap-7.3.6-1.17.amzn1.i686
php73-pspell-7.3.6-1.17.amzn1.i686
php73-ldap-7.3.6-1.17.amzn1.i686
php73-pdo-dblib-7.3.6-1.17.amzn1.i686
php73-recode-7.3.6-1.17.amzn1.i686
php73-snmp-7.3.6-1.17.amzn1.i686
php71-devel-7.1.30-1.40.amzn1.i686
php71-pdo-7.1.30-1.40.amzn1.i686
php71-pspell-7.1.30-1.40.amzn1.i686
php71-embedded-7.1.30-1.40.amzn1.i686
php71-json-7.1.30-1.40.amzn1.i686
php71-tidy-7.1.30-1.40.amzn1.i686
php71-debuginfo-7.1.30-1.40.amzn1.i686
php71-7.1.30-1.40.amzn1.i686
php71-pgsql-7.1.30-1.40.amzn1.i686
php71-ldap-7.1.30-1.40.amzn1.i686
php71-snmp-7.1.30-1.40.amzn1.i686
php71-gmp-7.1.30-1.40.amzn1.i686
php71-bcmath-7.1.30-1.40.amzn1.i686
php71-mcrypt-7.1.30-1.40.amzn1.i686
php71-common-7.1.30-1.40.amzn1.i686
php71-mbstring-7.1.30-1.40.amzn1.i686
php71-opcache-7.1.30-1.40.amzn1.i686
php71-fpm-7.1.30-1.40.amzn1.i686
php71-xmlrpc-7.1.30-1.40.amzn1.i686
php71-pdo-dblib-7.1.30-1.40.amzn1.i686
php71-recode-7.1.30-1.40.amzn1.i686
php71-dbg-7.1.30-1.40.amzn1.i686
php71-mysqlnd-7.1.30-1.40.amzn1.i686
php71-odbc-7.1.30-1.40.amzn1.i686
php71-cli-7.1.30-1.40.amzn1.i686
php71-xml-7.1.30-1.40.amzn1.i686
php71-imap-7.1.30-1.40.amzn1.i686
php71-process-7.1.30-1.40.amzn1.i686
php71-gd-7.1.30-1.40.amzn1.i686
php71-intl-7.1.30-1.40.amzn1.i686
php71-dba-7.1.30-1.40.amzn1.i686
php71-enchant-7.1.30-1.40.amzn1.i686
php71-soap-7.1.30-1.40.amzn1.i686
php72-dbg-7.2.19-1.14.amzn1.i686
php72-xmlrpc-7.2.19-1.14.amzn1.i686
php72-process-7.2.19-1.14.amzn1.i686
php72-imap-7.2.19-1.14.amzn1.i686
php72-mysqlnd-7.2.19-1.14.amzn1.i686
php72-bcmath-7.2.19-1.14.amzn1.i686
php72-pdo-7.2.19-1.14.amzn1.i686
php72-devel-7.2.19-1.14.amzn1.i686
php72-fpm-7.2.19-1.14.amzn1.i686
php72-ldap-7.2.19-1.14.amzn1.i686
php72-cli-7.2.19-1.14.amzn1.i686
php72-pgsql-7.2.19-1.14.amzn1.i686
php72-pdo-dblib-7.2.19-1.14.amzn1.i686
php72-snmp-7.2.19-1.14.amzn1.i686
php72-mbstring-7.2.19-1.14.amzn1.i686
php72-json-7.2.19-1.14.amzn1.i686
php72-intl-7.2.19-1.14.amzn1.i686
php72-debuginfo-7.2.19-1.14.amzn1.i686
php72-opcache-7.2.19-1.14.amzn1.i686
php72-pspell-7.2.19-1.14.amzn1.i686
php72-7.2.19-1.14.amzn1.i686
php72-recode-7.2.19-1.14.amzn1.i686
php72-common-7.2.19-1.14.amzn1.i686
php72-gd-7.2.19-1.14.amzn1.i686
php72-embedded-7.2.19-1.14.amzn1.i686
php72-enchant-7.2.19-1.14.amzn1.i686
php72-xml-7.2.19-1.14.amzn1.i686
php72-dba-7.2.19-1.14.amzn1.i686
php72-gmp-7.2.19-1.14.amzn1.i686
php72-odbc-7.2.19-1.14.amzn1.i686
php72-tidy-7.2.19-1.14.amzn1.i686
php72-soap-7.2.19-1.14.amzn1.i686
src:
php73-7.3.6-1.17.amzn1.src
php71-7.1.30-1.40.amzn1.src
php72-7.2.19-1.14.amzn1.src
x86_64:
php73-dbg-7.3.6-1.17.amzn1.x86_64
php73-recode-7.3.6-1.17.amzn1.x86_64
php73-mysqlnd-7.3.6-1.17.amzn1.x86_64
php73-devel-7.3.6-1.17.amzn1.x86_64
php73-xmlrpc-7.3.6-1.17.amzn1.x86_64
php73-pgsql-7.3.6-1.17.amzn1.x86_64
php73-xml-7.3.6-1.17.amzn1.x86_64
php73-opcache-7.3.6-1.17.amzn1.x86_64
php73-dba-7.3.6-1.17.amzn1.x86_64
php73-gmp-7.3.6-1.17.amzn1.x86_64
php73-cli-7.3.6-1.17.amzn1.x86_64
php73-json-7.3.6-1.17.amzn1.x86_64
php73-pdo-dblib-7.3.6-1.17.amzn1.x86_64
php73-mbstring-7.3.6-1.17.amzn1.x86_64
php73-fpm-7.3.6-1.17.amzn1.x86_64
php73-common-7.3.6-1.17.amzn1.x86_64
php73-intl-7.3.6-1.17.amzn1.x86_64
php73-imap-7.3.6-1.17.amzn1.x86_64
php73-soap-7.3.6-1.17.amzn1.x86_64
php73-debuginfo-7.3.6-1.17.amzn1.x86_64
php73-odbc-7.3.6-1.17.amzn1.x86_64
php73-embedded-7.3.6-1.17.amzn1.x86_64
php73-ldap-7.3.6-1.17.amzn1.x86_64
php73-bcmath-7.3.6-1.17.amzn1.x86_64
php73-snmp-7.3.6-1.17.amzn1.x86_64
php73-tidy-7.3.6-1.17.amzn1.x86_64
php73-gd-7.3.6-1.17.amzn1.x86_64
php73-pspell-7.3.6-1.17.amzn1.x86_64
php73-pdo-7.3.6-1.17.amzn1.x86_64
php73-process-7.3.6-1.17.amzn1.x86_64
php73-enchant-7.3.6-1.17.amzn1.x86_64
php73-7.3.6-1.17.amzn1.x86_64
php71-dba-7.1.30-1.40.amzn1.x86_64
php71-xml-7.1.30-1.40.amzn1.x86_64
php71-imap-7.1.30-1.40.amzn1.x86_64
php71-ldap-7.1.30-1.40.amzn1.x86_64
php71-bcmath-7.1.30-1.40.amzn1.x86_64
php71-mbstring-7.1.30-1.40.amzn1.x86_64
php71-gd-7.1.30-1.40.amzn1.x86_64
php71-fpm-7.1.30-1.40.amzn1.x86_64
php71-pdo-7.1.30-1.40.amzn1.x86_64
php71-soap-7.1.30-1.40.amzn1.x86_64
php71-process-7.1.30-1.40.amzn1.x86_64
php71-xmlrpc-7.1.30-1.40.amzn1.x86_64
php71-devel-7.1.30-1.40.amzn1.x86_64
php71-pspell-7.1.30-1.40.amzn1.x86_64
php71-mcrypt-7.1.30-1.40.amzn1.x86_64
php71-opcache-7.1.30-1.40.amzn1.x86_64
php71-gmp-7.1.30-1.40.amzn1.x86_64
php71-recode-7.1.30-1.40.amzn1.x86_64
php71-pdo-dblib-7.1.30-1.40.amzn1.x86_64
php71-embedded-7.1.30-1.40.amzn1.x86_64
php71-7.1.30-1.40.amzn1.x86_64
php71-snmp-7.1.30-1.40.amzn1.x86_64
php71-intl-7.1.30-1.40.amzn1.x86_64
php71-json-7.1.30-1.40.amzn1.x86_64
php71-mysqlnd-7.1.30-1.40.amzn1.x86_64
php71-cli-7.1.30-1.40.amzn1.x86_64
php71-debuginfo-7.1.30-1.40.amzn1.x86_64
php71-pgsql-7.1.30-1.40.amzn1.x86_64
php71-enchant-7.1.30-1.40.amzn1.x86_64
php71-common-7.1.30-1.40.amzn1.x86_64
php71-tidy-7.1.30-1.40.amzn1.x86_64
php71-dbg-7.1.30-1.40.amzn1.x86_64
php71-odbc-7.1.30-1.40.amzn1.x86_64
php72-bcmath-7.2.19-1.14.amzn1.x86_64
php72-soap-7.2.19-1.14.amzn1.x86_64
php72-odbc-7.2.19-1.14.amzn1.x86_64
php72-mbstring-7.2.19-1.14.amzn1.x86_64
php72-tidy-7.2.19-1.14.amzn1.x86_64
php72-embedded-7.2.19-1.14.amzn1.x86_64
php72-7.2.19-1.14.amzn1.x86_64
php72-pspell-7.2.19-1.14.amzn1.x86_64
php72-gmp-7.2.19-1.14.amzn1.x86_64
php72-imap-7.2.19-1.14.amzn1.x86_64
php72-debuginfo-7.2.19-1.14.amzn1.x86_64
php72-dba-7.2.19-1.14.amzn1.x86_64
php72-mysqlnd-7.2.19-1.14.amzn1.x86_64
php72-ldap-7.2.19-1.14.amzn1.x86_64
php72-process-7.2.19-1.14.amzn1.x86_64
php72-xmlrpc-7.2.19-1.14.amzn1.x86_64
php72-common-7.2.19-1.14.amzn1.x86_64
php72-dbg-7.2.19-1.14.amzn1.x86_64
php72-pdo-7.2.19-1.14.amzn1.x86_64
php72-enchant-7.2.19-1.14.amzn1.x86_64
php72-cli-7.2.19-1.14.amzn1.x86_64
php72-devel-7.2.19-1.14.amzn1.x86_64
php72-snmp-7.2.19-1.14.amzn1.x86_64
php72-json-7.2.19-1.14.amzn1.x86_64
php72-xml-7.2.19-1.14.amzn1.x86_64
php72-intl-7.2.19-1.14.amzn1.x86_64
php72-opcache-7.2.19-1.14.amzn1.x86_64
php72-pgsql-7.2.19-1.14.amzn1.x86_64
php72-recode-7.2.19-1.14.amzn1.x86_64
php72-gd-7.2.19-1.14.amzn1.x86_64
php72-fpm-7.2.19-1.14.amzn1.x86_64
php72-pdo-dblib-7.2.19-1.14.amzn1.x86_64
Additional References
Red Hat: CVE-2019-11038, CVE-2019-11039, CVE-2019-11040
Mitre: CVE-2019-11038, CVE-2019-11039, CVE-2019-11040
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Amazon Linux | 1 | i686 | php73-fpm | < 7.3.6-1.17.amzn1 | php73-fpm-7.3.6-1.17.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php73-gd | < 7.3.6-1.17.amzn1 | php73-gd-7.3.6-1.17.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php73-bcmath | < 7.3.6-1.17.amzn1 | php73-bcmath-7.3.6-1.17.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php73-mysqlnd | < 7.3.6-1.17.amzn1 | php73-mysqlnd-7.3.6-1.17.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php73-common | < 7.3.6-1.17.amzn1 | php73-common-7.3.6-1.17.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php73-cli | < 7.3.6-1.17.amzn1 | php73-cli-7.3.6-1.17.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php73-tidy | < 7.3.6-1.17.amzn1 | php73-tidy-7.3.6-1.17.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php73-odbc | < 7.3.6-1.17.amzn1 | php73-odbc-7.3.6-1.17.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php73-json | < 7.3.6-1.17.amzn1 | php73-json-7.3.6-1.17.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php73-xmlrpc | < 7.3.6-1.17.amzn1 | php73-xmlrpc-7.3.6-1.17.amzn1.i686.rpm |
Related
nessus
nessus
Amazon Linux AMI : php71 / php72,php73 (ALAS-2019-1240)
2019-07-26 00:00:00
Fedora 29 : php (2019-8c4b25b5ec)
2019-06-10 00:00:00
PHP 7.1.x < 7.1.30 Multiple Vulnerabilities.
2019-05-31 00:00:00
openvas
openvas
PHP 7.1.x < 7.1.30, 7.2.x < 7.2.19, 7.3.x < 7.3.6 Multiple Vulnerabilities - Linux
2021-10-25 00:00:00
Fedora Update for php FEDORA-2019-be4f895015
2019-06-06 00:00:00
ibm
ibm
fedora
fedora
[SECURITY] Fedora 30 Update: php-7.3.6-1.fc30
2019-06-06 01:07:20
[SECURITY] Fedora 29 Update: php-7.2.19-2.fc29
2019-06-08 02:13:48
[SECURITY] Fedora 32 Update: gd-2.3.0-1.fc32
2020-03-31 00:19:46
suse
suse
Security update for php7 (moderate)
2019-07-21 00:00:00
Security update for gd (moderate)
2020-03-10 00:00:00
osv
osv
php5 - security update
2019-06-03 00:00:00
CVE-2019-11038
2019-06-19 00:15:12
libgd2 - security update
2019-06-11 00:00:00
debian
debian
[SECURITY] [DLA 1813-1] php5 security update
2019-06-03 11:19:11
[SECURITY] [DSA 4529-1] php7.0 security update
2019-09-20 17:58:44
[SECURITY] [DSA 4527-1] php7.3 security update
2019-09-19 20:47:45
ubuntu
ubuntu
PHP vulnerabilities
2019-06-05 00:00:00
PHP vulnerabilities
2019-06-05 00:00:00
GD Graphics Library vulnerabilities
2020-04-02 00:00:00
prion
prion
Code injection
2019-06-19 00:15:00
Information disclosure
2019-06-19 00:15:00
Integer overflow
2019-06-19 00:15:00
mageia
mageia
Updated libgd packages fix security vulnerability
2020-03-09 01:37:31
redhatcve
redhatcve
veracode
veracode
Information Disclosure
2019-08-20 00:10:42
Denial Of Service (Dos)
2019-08-20 00:10:42
Information Disclosure
2019-08-20 00:10:42
ubuntucve
ubuntucve
cve
cve
alpinelinux
alpinelinux
hackerone
hackerone
Internet Bug Bounty: Uninitialized read in gdImageCreateFromXbm
2019-06-21 02:53:16
Internet Bug Bounty: Out-of-bounds read in iconv.c:_php_iconv_mime_decode() due to integer overflow
2019-05-31 09:58:15
Internet Bug Bounty: Out of Bounds Memory Read in php_jpg_get16
2019-08-01 05:45:21
debiancve
debiancve
altlinux
altlinux
Security fix for the ALT Linux 10 package php8.1 version 7.2.19-alt1
2019-06-01 00:00:00
Security fix for the ALT Linux 10 package php8.0 version 7.2.19-alt1
2019-06-01 00:00:00
Security fix for the ALT Linux 8 package php7 version 7.2.19-alt1
2019-06-05 00:00:00
photon
photon
Home
Download Photon OS
User Documentation
FAQ
Security Advisories
Related Information
Lightwave - PHSA-2020-2.0-0297
2020-11-20 00:00:00
Important Photon OS Security Update - PHSA-2020-0164
2020-11-23 00:00:00
Important Photon OS Security Update - PHSA-2020-3.0-0164
2020-11-23 00:00:00
cloudfoundry
cloudfoundry
USN-4316-1: GD Graphics Library vulnerabilities | Cloud Foundry
2020-04-16 00:00:00
redhat
redhat
(RHSA-2019:3299) Critical: rh-php72-php security update
2019-11-01 12:22:19
(RHSA-2020:1624) Moderate: php:7.2 security, bug fix, and enhancement update
2020-04-28 08:57:54
slackware
slackware
[slackware-security] gd
2020-03-23 20:45:50
oraclelinux
oraclelinux
php:7.2 security, bug fix, and enhancement update
2020-05-05 00:00:00
php:7.3 security, bug fix, and enhancement update
2020-09-09 00:00:00
almalinux
almalinux
Moderate: php:7.2 security, bug fix, and enhancement update
2020-04-28 08:57:54
Moderate: php:7.3 security, bug fix, and enhancement update
2020-09-08 08:38:31
rocky
rocky
php:7.2 security, bug fix, and enhancement update
2020-04-28 08:57:54
php:7.3 security, bug fix, and enhancement update
2020-09-08 08:38:31
9.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
6.4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:N/A:P
0.007 Low
EPSS
Percentile
80.0%
Related for ALAS-2019-1240