SB2019110109 - Red Hat update for rh-php72-php
Published: November 1, 2019 Updated: October 31, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 21 secuirty vulnerabilities.
1) Out-of-bounds read (CVE-ID: CVE-2019-11038)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD). A remote attacker can create a specially crafted image, pass it to the affected application, trigger out-of-bounds read error and read contents of memory on the system.
2) Out-of-bounds read (CVE-ID: CVE-2019-11036)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in exif_process_IFD_TAG() function in PHP EXIF extension. A remote attacker can send a specially crafted file to the affected application, trigger out-of-bounds read error and read contents of memory on the system or crash the process.
3) Out-of-bounds read (CVE-ID: CVE-2019-11035)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition within the exif_iif_add_value() function in PHP EXIF extension when processing certain files. An attacker can pass a specially crafted file to the application, trigger out-of-bounds read error and read contents of memory on the system or perform a denial of service attack.4) Out-of-bounds read (CVE-ID: CVE-2019-11034)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition within the exif_process_IFD_TAG() function in PHP EXIF extension when processing certain files. An attacker can pass a specially crafted file to the application, trigger out-of-bounds read error and read contents of memory on the system or perform a denial of service attack.
5) Integer overflow (CVE-ID: CVE-2019-11039)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to integer overflow in iconv_mime_decode_headers() function when processing MIME headers. A remote attacker can trigger integer overflow and gain access to sensitive information or trigger application crash.
6) Out-of-bounds read (CVE-ID: CVE-2019-11040)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in exif_read_data() function when parsing EXIF data. A remote attacker can create a specially crafted image, pass it to the affected application, trigger out-of-bounds read error and read contents of memory on the system.
7) Buffer overflow (CVE-ID: CVE-2019-11043)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in env_path_info in PHP-FPM when processing untrusted input passed via URL. A remote attacker can send a specially crafted HTTP request to the affected server, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system but requires that php-fpm is used with nginx and certain nginx configuration was applied:
- The nginx location directive forwards requests to PHP-FPM
- The fastcgi_split_path_info directive is present and includes a regular expression beginning with a ‘^’ symbol and ending with a ‘$’ symbol
- The fastcgi_param directive is used to assign the PATH_INFO variable
- There are no checks in place to determine whether or not a file exists (e.g., using try_files or an if statemen
8) Out-of-bounds read (CVE-ID: CVE-2019-11042)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition within the exif_read_data() function in PHP EXIF extention. A remote attacker can create a specially crafted image file, pass it to the application, trigger out-of-bounds read error and read contents of memory on the system.
9) Out-of-bounds read (CVE-ID: CVE-2019-11041)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition within the exif_read_data() function. A remote attacker can create a specially crafted image file, pass it to the application, trigger out-of-bounds read error and read contents of memory on the system.
10) Out-of-bounds read (CVE-ID: CVE-2019-9640)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in exif_process_SOFn within the PHP EXIF component. A remote attacker can create a specially crafted image file, pass it to the affected application, trigger out-of-bounds read error and read contents of memory on the system.
11) Out-of-bounds read (CVE-ID: CVE-2019-9021)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition within the phar_detect_phar_fname_ext() function in ext/phar/phar.c (PHAR extension) when reading PHAR archives. A remote attacker can create a specially crafted PHAR archive, pass it to the affected application, trigger out-of-bounds read error and read contents of memory on the system.
12) Out-of-bounds read (CVE-ID: CVE-2019-9020)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition within the xml_elem_parse_buf() in ext/xmlrpc/libxmlrpc/xml_element.c when reading XML data via the xmlrpc_decode() PHP function. A remote attacker can create a specially crafted XML file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.
13) Out-of-bounds write (CVE-ID: CVE-2019-6977)
The vulnerability allows a remote attacker to execute arbitrary on the target system.The weakness exists due to out-of-bounds write in imagecolormatch. A remote attacker can write up to 1200 bytes over the boundaries of a buffer allocated in the imagecolormatch function, which then calls gdImageColorMatch() and execute arbitrary code with elevated privileges.
14) Improper access control (CVE-ID: CVE-2018-20783)
The vulnerability allows an adjacent attacker to bypass authentication on the target system.
The vulnerability exists due to improper access control. An adjacent attacker can force-pair the device without human interaction.
15) Out-of-bounds read (CVE-ID: CVE-2019-9022)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition within the php_parserr in ext/standard/dns.c when processing DNS_CAA and DNS_ANY responses. A remote attacker controlling a malicious DNS server can trigger out-of-bounds read error and read contents of memory on the system.
16) Race condition (CVE-ID: CVE-2019-9637)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a race condition when renaming files on the system, as the rename() PHP function temporary creates files with weak privileges. A local user can exploit this behavior to gain access to sensitive information.
17) Integer underflow (CVE-ID: CVE-2016-10166)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack and potentially compromise vulnerable system.The vulnerability exists due to integer underflow when decrementing the "u" variable in _gdContributionsAlloc() function in gd_interpolation.c. A remote attacker create a specially crafted image file, trigger memory corruption and crash the affected application or execute arbitrary code on the target system.
18) Out-of-bounds read (CVE-ID: CVE-2019-9023)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a multiple boundary condition within the ext/mbstring/oniguruma/regcomp.c, ext/mbstring/oniguruma/regexec.c, ext/mbstring/oniguruma/regparse.c, ext/mbstring/oniguruma/enc/unicode.c, and ext/mbstring/oniguruma/src/utf32_be.c files when parsing multibyte data in regular expressions. A remote attacker can pass specially crafted input to the application, trigger out-of-bounds read error and read contents of memory on the system.
19) Out-of-bounds read (CVE-ID: CVE-2019-9024)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition within the base64_decode_xmlrpc() function in ext/xmlrpc/libxmlrpc/base64.c when parsing untrusted input via the xmlrpc_decode() PHP function. A remote attacker can setup a malicious XMLRPC server, trick the application into connecting to it, trigger out-of-bounds read error and read contents of memory on the system.
20) Out-of-bounds read (CVE-ID: CVE-2019-9638)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in the EXIF component within exif_process_IFD_in_MAKERNOTE when converting maker_note->offset relationship to value_len. A remote attacker can trigger an out-of-bounds read error and read contents of memory on the system.
21) Out-of-bounds read (CVE-ID: CVE-2019-9639)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in the EXIF component in exif_process_IFD_in_MAKERNOTE when handling the data_len variable. A remote attacker can trigger out-of-bounds read error and read contents of memory on the system.
Remediation
Install update from vendor's website.