Fedora 29 : php (2019-f07db8f031)

PHP version 7.2.21 01 Aug 2019 Date: - Fixed bug php69044 discrepency between time and microtime. krakjoe EXIF: - Fixed bug php78256 heap-buffer-overflow on exifprocessusercomment. CVE-2019-11042 Stas - Fixed bug php78222 heap-buffer-overflow on exifscanthumbnail. CVE-2019-11041 Stas Fileinfo: -...

CVE-2019-11042 heap-buffer-overflow on exif_process_user_comment in EXIF extension

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exifreaddata function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information...

CVE-2019-11042

CVE-2019-11042 affects PHP’s EXIF extension when parsing EXIF data (exif_read_data) across PHP 7.1.x < 7.1.31, 7.2.x < 7.2.21, and 7.3.x

Security fix for the ALT Linux 8 package php7 version 7.2.21-alt1

Aug. 3, 2019 Anton Farygin 7.2.21-alt1 - 7.2.21 Fixes: CVE-2019-11042, CVE-2019-11041...

Security fix for the ALT Linux 9 package php7 version 7.2.21-alt1

Aug. 3, 2019 Anton Farygin 7.2.21-alt1 - 7.2.21 Fixes: CVE-2019-11042, CVE-2019-11041...

Security fix for the ALT Linux 10 package php8.0 version 7.2.21-alt1

Aug. 3, 2019 Anton Farygin 7.2.21-alt1 - 7.2.21 Fixes: CVE-2019-11042, CVE-2019-11041...

Security fix for the ALT Linux 10 package php8.1 version 7.2.21-alt1

Aug. 3, 2019 Anton Farygin 7.2.21-alt1 - 7.2.21 Fixes: CVE-2019-11042, CVE-2019-11041...

CVE-2018-11042

CVE-2018-11042 is rejected/not used; the CNA withdrew it, and it is not a security issue.

CVE-2018-11042

...

CVE-2017-11042

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, ImsService and the IQtiImsExt AIDL APIs are not subject to access control...

CVE-2017-11042

CVE-2017-11042 affects Android for MSM, Firefox OS for MSM, and QRD Android builds with CAF Linux kernel, where ImsService and IQtiImsExt AIDL APIs lack access control. Root cause: insufficient access restrictions on these ImsService interfaces. Exploitation would be local (CVSS2/3 reflect LOCAL,...