PHP 7.3.x < 7.3.8 Multiple Vulnerabilities

According to its banner, the version of PHP running on the remote web server is 7.1.x prior to 7.1.31, 7.2.x prior to 7.2.21 or 7.3.x prior to 7.3.8. It is, therefore, affected by the following vulnerabilities:

• A heap-based buffer overflow condition exists on exif_scan_thumbnail. An attacker can exploit this, to cause a denial of service condition or the execution of arbitrary code. (CVE-2019-11041)

• A heap-based buffer overflow condition exists on exif_process_user_comment. An attacker can exploit this, to cause a denial of service condition or the execution of arbitrary code. (CVE-2019-11042)

Note that the scanner has not tested for these issues but has instead relied only on the application’s self-reported version number.