Lucene search
AmazonALAS-2019-1240HistoryJul 17, 2019 - 11:33 p.m.
Medium: php71, php72, php73
2019-07-1723:33:00
alas.aws.amazon.com
118
CVSS2
6.4
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:N/A:P
CVSS3
9.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
EPSS
0.009
Percentile
83.0%
Issue Overview:
Function iconv_mime_decode_headers() in PHP may perform out-of-buffer read due to integer overflow when parsing MIME headers. This may lead to information disclosure or crash.(CVE-2019-11039)
When using gdImageCreateFromXbm() function of PHP gd extension, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been left there by previous code. (CVE-2019-11038)
When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash. (CVE-2019-11040)
Affected Packages:
php71, php72, php73
Issue Correction:
Run yum update php71 to update your system.
Run yum update php72 to update your system.
Run yum update php73 to update your system.
New Packages:
i686:
php73-fpm-7.3.6-1.17.amzn1.i686
php73-gd-7.3.6-1.17.amzn1.i686
php73-bcmath-7.3.6-1.17.amzn1.i686
php73-mysqlnd-7.3.6-1.17.amzn1.i686
php73-common-7.3.6-1.17.amzn1.i686
php73-cli-7.3.6-1.17.amzn1.i686
php73-tidy-7.3.6-1.17.amzn1.i686
php73-odbc-7.3.6-1.17.amzn1.i686
php73-json-7.3.6-1.17.amzn1.i686
php73-xmlrpc-7.3.6-1.17.amzn1.i686
php73-pgsql-7.3.6-1.17.amzn1.i686
php73-intl-7.3.6-1.17.amzn1.i686
php73-mbstring-7.3.6-1.17.amzn1.i686
php73-pdo-7.3.6-1.17.amzn1.i686
php73-imap-7.3.6-1.17.amzn1.i686
php73-debuginfo-7.3.6-1.17.amzn1.i686
php73-gmp-7.3.6-1.17.amzn1.i686
php73-dbg-7.3.6-1.17.amzn1.i686
php73-embedded-7.3.6-1.17.amzn1.i686
php73-opcache-7.3.6-1.17.amzn1.i686
php73-dba-7.3.6-1.17.amzn1.i686
php73-xml-7.3.6-1.17.amzn1.i686
php73-process-7.3.6-1.17.amzn1.i686
php73-devel-7.3.6-1.17.amzn1.i686
php73-7.3.6-1.17.amzn1.i686
php73-enchant-7.3.6-1.17.amzn1.i686
php73-soap-7.3.6-1.17.amzn1.i686
php73-pspell-7.3.6-1.17.amzn1.i686
php73-ldap-7.3.6-1.17.amzn1.i686
php73-pdo-dblib-7.3.6-1.17.amzn1.i686
php73-recode-7.3.6-1.17.amzn1.i686
php73-snmp-7.3.6-1.17.amzn1.i686
php71-devel-7.1.30-1.40.amzn1.i686
php71-pdo-7.1.30-1.40.amzn1.i686
php71-pspell-7.1.30-1.40.amzn1.i686
php71-embedded-7.1.30-1.40.amzn1.i686
php71-json-7.1.30-1.40.amzn1.i686
php71-tidy-7.1.30-1.40.amzn1.i686
php71-debuginfo-7.1.30-1.40.amzn1.i686
php71-7.1.30-1.40.amzn1.i686
php71-pgsql-7.1.30-1.40.amzn1.i686
php71-ldap-7.1.30-1.40.amzn1.i686
php71-snmp-7.1.30-1.40.amzn1.i686
php71-gmp-7.1.30-1.40.amzn1.i686
php71-bcmath-7.1.30-1.40.amzn1.i686
php71-mcrypt-7.1.30-1.40.amzn1.i686
php71-common-7.1.30-1.40.amzn1.i686
php71-mbstring-7.1.30-1.40.amzn1.i686
php71-opcache-7.1.30-1.40.amzn1.i686
php71-fpm-7.1.30-1.40.amzn1.i686
php71-xmlrpc-7.1.30-1.40.amzn1.i686
php71-pdo-dblib-7.1.30-1.40.amzn1.i686
php71-recode-7.1.30-1.40.amzn1.i686
php71-dbg-7.1.30-1.40.amzn1.i686
php71-mysqlnd-7.1.30-1.40.amzn1.i686
php71-odbc-7.1.30-1.40.amzn1.i686
php71-cli-7.1.30-1.40.amzn1.i686
php71-xml-7.1.30-1.40.amzn1.i686
php71-imap-7.1.30-1.40.amzn1.i686
php71-process-7.1.30-1.40.amzn1.i686
php71-gd-7.1.30-1.40.amzn1.i686
php71-intl-7.1.30-1.40.amzn1.i686
php71-dba-7.1.30-1.40.amzn1.i686
php71-enchant-7.1.30-1.40.amzn1.i686
php71-soap-7.1.30-1.40.amzn1.i686
php72-dbg-7.2.19-1.14.amzn1.i686
php72-xmlrpc-7.2.19-1.14.amzn1.i686
php72-process-7.2.19-1.14.amzn1.i686
php72-imap-7.2.19-1.14.amzn1.i686
php72-mysqlnd-7.2.19-1.14.amzn1.i686
php72-bcmath-7.2.19-1.14.amzn1.i686
php72-pdo-7.2.19-1.14.amzn1.i686
php72-devel-7.2.19-1.14.amzn1.i686
php72-fpm-7.2.19-1.14.amzn1.i686
php72-ldap-7.2.19-1.14.amzn1.i686
php72-cli-7.2.19-1.14.amzn1.i686
php72-pgsql-7.2.19-1.14.amzn1.i686
php72-pdo-dblib-7.2.19-1.14.amzn1.i686
php72-snmp-7.2.19-1.14.amzn1.i686
php72-mbstring-7.2.19-1.14.amzn1.i686
php72-json-7.2.19-1.14.amzn1.i686
php72-intl-7.2.19-1.14.amzn1.i686
php72-debuginfo-7.2.19-1.14.amzn1.i686
php72-opcache-7.2.19-1.14.amzn1.i686
php72-pspell-7.2.19-1.14.amzn1.i686
php72-7.2.19-1.14.amzn1.i686
php72-recode-7.2.19-1.14.amzn1.i686
php72-common-7.2.19-1.14.amzn1.i686
php72-gd-7.2.19-1.14.amzn1.i686
php72-embedded-7.2.19-1.14.amzn1.i686
php72-enchant-7.2.19-1.14.amzn1.i686
php72-xml-7.2.19-1.14.amzn1.i686
php72-dba-7.2.19-1.14.amzn1.i686
php72-gmp-7.2.19-1.14.amzn1.i686
php72-odbc-7.2.19-1.14.amzn1.i686
php72-tidy-7.2.19-1.14.amzn1.i686
php72-soap-7.2.19-1.14.amzn1.i686
src:
php73-7.3.6-1.17.amzn1.src
php71-7.1.30-1.40.amzn1.src
php72-7.2.19-1.14.amzn1.src
x86_64:
php73-dbg-7.3.6-1.17.amzn1.x86_64
php73-recode-7.3.6-1.17.amzn1.x86_64
php73-mysqlnd-7.3.6-1.17.amzn1.x86_64
php73-devel-7.3.6-1.17.amzn1.x86_64
php73-xmlrpc-7.3.6-1.17.amzn1.x86_64
php73-pgsql-7.3.6-1.17.amzn1.x86_64
php73-xml-7.3.6-1.17.amzn1.x86_64
php73-opcache-7.3.6-1.17.amzn1.x86_64
php73-dba-7.3.6-1.17.amzn1.x86_64
php73-gmp-7.3.6-1.17.amzn1.x86_64
php73-cli-7.3.6-1.17.amzn1.x86_64
php73-json-7.3.6-1.17.amzn1.x86_64
php73-pdo-dblib-7.3.6-1.17.amzn1.x86_64
php73-mbstring-7.3.6-1.17.amzn1.x86_64
php73-fpm-7.3.6-1.17.amzn1.x86_64
php73-common-7.3.6-1.17.amzn1.x86_64
php73-intl-7.3.6-1.17.amzn1.x86_64
php73-imap-7.3.6-1.17.amzn1.x86_64
php73-soap-7.3.6-1.17.amzn1.x86_64
php73-debuginfo-7.3.6-1.17.amzn1.x86_64
php73-odbc-7.3.6-1.17.amzn1.x86_64
php73-embedded-7.3.6-1.17.amzn1.x86_64
php73-ldap-7.3.6-1.17.amzn1.x86_64
php73-bcmath-7.3.6-1.17.amzn1.x86_64
php73-snmp-7.3.6-1.17.amzn1.x86_64
php73-tidy-7.3.6-1.17.amzn1.x86_64
php73-gd-7.3.6-1.17.amzn1.x86_64
php73-pspell-7.3.6-1.17.amzn1.x86_64
php73-pdo-7.3.6-1.17.amzn1.x86_64
php73-process-7.3.6-1.17.amzn1.x86_64
php73-enchant-7.3.6-1.17.amzn1.x86_64
php73-7.3.6-1.17.amzn1.x86_64
php71-dba-7.1.30-1.40.amzn1.x86_64
php71-xml-7.1.30-1.40.amzn1.x86_64
php71-imap-7.1.30-1.40.amzn1.x86_64
php71-ldap-7.1.30-1.40.amzn1.x86_64
php71-bcmath-7.1.30-1.40.amzn1.x86_64
php71-mbstring-7.1.30-1.40.amzn1.x86_64
php71-gd-7.1.30-1.40.amzn1.x86_64
php71-fpm-7.1.30-1.40.amzn1.x86_64
php71-pdo-7.1.30-1.40.amzn1.x86_64
php71-soap-7.1.30-1.40.amzn1.x86_64
php71-process-7.1.30-1.40.amzn1.x86_64
php71-xmlrpc-7.1.30-1.40.amzn1.x86_64
php71-devel-7.1.30-1.40.amzn1.x86_64
php71-pspell-7.1.30-1.40.amzn1.x86_64
php71-mcrypt-7.1.30-1.40.amzn1.x86_64
php71-opcache-7.1.30-1.40.amzn1.x86_64
php71-gmp-7.1.30-1.40.amzn1.x86_64
php71-recode-7.1.30-1.40.amzn1.x86_64
php71-pdo-dblib-7.1.30-1.40.amzn1.x86_64
php71-embedded-7.1.30-1.40.amzn1.x86_64
php71-7.1.30-1.40.amzn1.x86_64
php71-snmp-7.1.30-1.40.amzn1.x86_64
php71-intl-7.1.30-1.40.amzn1.x86_64
php71-json-7.1.30-1.40.amzn1.x86_64
php71-mysqlnd-7.1.30-1.40.amzn1.x86_64
php71-cli-7.1.30-1.40.amzn1.x86_64
php71-debuginfo-7.1.30-1.40.amzn1.x86_64
php71-pgsql-7.1.30-1.40.amzn1.x86_64
php71-enchant-7.1.30-1.40.amzn1.x86_64
php71-common-7.1.30-1.40.amzn1.x86_64
php71-tidy-7.1.30-1.40.amzn1.x86_64
php71-dbg-7.1.30-1.40.amzn1.x86_64
php71-odbc-7.1.30-1.40.amzn1.x86_64
php72-bcmath-7.2.19-1.14.amzn1.x86_64
php72-soap-7.2.19-1.14.amzn1.x86_64
php72-odbc-7.2.19-1.14.amzn1.x86_64
php72-mbstring-7.2.19-1.14.amzn1.x86_64
php72-tidy-7.2.19-1.14.amzn1.x86_64
php72-embedded-7.2.19-1.14.amzn1.x86_64
php72-7.2.19-1.14.amzn1.x86_64
php72-pspell-7.2.19-1.14.amzn1.x86_64
php72-gmp-7.2.19-1.14.amzn1.x86_64
php72-imap-7.2.19-1.14.amzn1.x86_64
php72-debuginfo-7.2.19-1.14.amzn1.x86_64
php72-dba-7.2.19-1.14.amzn1.x86_64
php72-mysqlnd-7.2.19-1.14.amzn1.x86_64
php72-ldap-7.2.19-1.14.amzn1.x86_64
php72-process-7.2.19-1.14.amzn1.x86_64
php72-xmlrpc-7.2.19-1.14.amzn1.x86_64
php72-common-7.2.19-1.14.amzn1.x86_64
php72-dbg-7.2.19-1.14.amzn1.x86_64
php72-pdo-7.2.19-1.14.amzn1.x86_64
php72-enchant-7.2.19-1.14.amzn1.x86_64
php72-cli-7.2.19-1.14.amzn1.x86_64
php72-devel-7.2.19-1.14.amzn1.x86_64
php72-snmp-7.2.19-1.14.amzn1.x86_64
php72-json-7.2.19-1.14.amzn1.x86_64
php72-xml-7.2.19-1.14.amzn1.x86_64
php72-intl-7.2.19-1.14.amzn1.x86_64
php72-opcache-7.2.19-1.14.amzn1.x86_64
php72-pgsql-7.2.19-1.14.amzn1.x86_64
php72-recode-7.2.19-1.14.amzn1.x86_64
php72-gd-7.2.19-1.14.amzn1.x86_64
php72-fpm-7.2.19-1.14.amzn1.x86_64
php72-pdo-dblib-7.2.19-1.14.amzn1.x86_64
Additional References
Red Hat: CVE-2019-11038, CVE-2019-11039, CVE-2019-11040
Mitre: CVE-2019-11038, CVE-2019-11039, CVE-2019-11040
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Amazon Linux | 1 | i686 | php73-fpm | < 7.3.6-1.17.amzn1 | php73-fpm-7.3.6-1.17.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php73-gd | < 7.3.6-1.17.amzn1 | php73-gd-7.3.6-1.17.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php73-bcmath | < 7.3.6-1.17.amzn1 | php73-bcmath-7.3.6-1.17.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php73-mysqlnd | < 7.3.6-1.17.amzn1 | php73-mysqlnd-7.3.6-1.17.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php73-common | < 7.3.6-1.17.amzn1 | php73-common-7.3.6-1.17.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php73-cli | < 7.3.6-1.17.amzn1 | php73-cli-7.3.6-1.17.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php73-tidy | < 7.3.6-1.17.amzn1 | php73-tidy-7.3.6-1.17.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php73-odbc | < 7.3.6-1.17.amzn1 | php73-odbc-7.3.6-1.17.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php73-json | < 7.3.6-1.17.amzn1 | php73-json-7.3.6-1.17.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php73-xmlrpc | < 7.3.6-1.17.amzn1 | php73-xmlrpc-7.3.6-1.17.amzn1.i686.rpm |
Related
nessus
nessus
PHP 7.1.x < 7.1.30 Multiple Vulnerabilities
2019-06-18 00:00:00
PHP 7.3.x < 7.3.6 Multiple Vulnerabilities.
2019-06-04 00:00:00
PHP 7.2.x < 7.2.19 Multiple Vulnerabilities.
2019-05-31 00:00:00
ibm
ibm
openvas
openvas
Fedora Update for php FEDORA-2019-be4f895015
2019-06-06 00:00:00
fedora
fedora
[SECURITY] Fedora 30 Update: php-7.3.6-1.fc30
2019-06-06 01:07:20
[SECURITY] Fedora 29 Update: php-7.2.19-2.fc29
2019-06-08 02:13:48
[SECURITY] Fedora 32 Update: gd-2.3.0-1.fc32
2020-03-31 00:19:46
suse
suse
Security update for php7 (moderate)
2019-07-21 00:00:00
Security update for gd (moderate)
2020-03-10 00:00:00
debian
debian
[SECURITY] [DLA 1813-1] php5 security update
2019-06-03 11:19:11
[SECURITY] [DSA 4529-1] php7.0 security update
2019-09-20 17:58:44
[SECURITY] [DLA 1817-1] libgd2 security update
2019-06-11 16:24:45
osv
osv
php5 - security update
2019-06-03 00:00:00
CVE-2019-11038
2019-06-19 00:15:12
libgd2 - security update
2019-06-11 00:00:00
ubuntu
ubuntu
PHP vulnerabilities
2019-06-05 00:00:00
PHP vulnerabilities
2019-06-05 00:00:00
GD Graphics Library vulnerabilities
2020-04-02 00:00:00
prion
prion
Code injection
2019-06-19 00:15:00
Information disclosure
2019-06-19 00:15:00
Integer overflow
2019-06-19 00:15:00
mageia
mageia
Updated libgd packages fix security vulnerability
2020-03-09 01:37:31
hackerone
hackerone
Internet Bug Bounty: Uninitialized read in gdImageCreateFromXbm
2019-06-21 02:53:16
Internet Bug Bounty: Out-of-bounds read in iconv.c:_php_iconv_mime_decode() due to integer overflow
2019-05-31 09:58:15
Internet Bug Bounty: Out of Bounds Memory Read in php_jpg_get16
2019-08-01 05:45:21
debiancve
debiancve
veracode
veracode
Denial Of Service (Dos)
2019-08-20 00:10:42
Information Disclosure
2019-08-20 00:10:42
Information Disclosure
2019-08-20 00:10:42
alpinelinux
alpinelinux
ubuntucve
ubuntucve
redhatcve
redhatcve
cvelist
cvelist
CVE-2019-11038 Uninitialized read in gdImageCreateFromXbm
2019-05-28 00:00:00
CVE-2019-11039 Out-of-bounds read in iconv.c
2019-05-28 00:00:00
CVE-2019-11040 Heap buffer overflow in EXIF extension
2019-05-28 00:00:00
cve
cve
nvd
nvd
altlinux
altlinux
Security fix for the ALT Linux 10 package php8.1 version 7.2.19-alt1
2019-06-01 00:00:00
Security fix for the ALT Linux 10 package php8.0 version 7.2.19-alt1
2019-06-01 00:00:00
Security fix for the ALT Linux 9 package php7 version 7.2.19-alt1
2019-06-02 00:00:00
photon
photon
Home
Download Photon OS
User Documentation
FAQ
Security Advisories
Related Information
Lightwave - PHSA-2020-2.0-0297
2020-11-20 00:00:00
Important Photon OS Security Update - PHSA-2020-0164
2020-11-23 00:00:00
Important Photon OS Security Update - PHSA-2020-3.0-0164
2020-11-23 00:00:00
cloudfoundry
cloudfoundry
USN-4316-1: GD Graphics Library vulnerabilities | Cloud Foundry
2020-04-16 00:00:00
redhat
redhat
(RHSA-2019:3299) Critical: rh-php72-php security update
2019-11-01 12:22:19
(RHSA-2020:1624) Moderate: php:7.2 security, bug fix, and enhancement update
2020-04-28 08:57:54
slackware
slackware
[slackware-security] gd
2020-03-23 20:45:50
rocky
rocky
php:7.2 security, bug fix, and enhancement update
2020-04-28 08:57:54
php:7.3 security, bug fix, and enhancement update
2020-09-08 08:38:31
oraclelinux
oraclelinux
php:7.2 security, bug fix, and enhancement update
2020-05-05 00:00:00
php:7.3 security, bug fix, and enhancement update
2020-09-09 00:00:00
almalinux
almalinux
Moderate: php:7.2 security, bug fix, and enhancement update
2020-04-28 08:57:54
Moderate: php:7.3 security, bug fix, and enhancement update
2020-09-08 08:38:31
CVSS2
6.4
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:N/A:P
CVSS3
9.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
EPSS
0.009
Percentile
83.0%
Related for ALAS-2019-1240