Vulnerability Description
An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling the maker_note->offset relationship to value_len.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Php | Php | < 7.1.27 |
| Debian | Debian Linux | 8.0 |
| Canonical | Ubuntu Linux | 12.04 |
| Opensuse | Leap | 15.0 |
| Netapp | Storage Automation Store | - |
| Redhat | Software Collections | 1.0 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00104.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00012.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.htmlMailing ListThird Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2519Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3299Third Party Advisory
- https://bugs.php.net/bug.php?id=77563ExploitIssue TrackingPatch
- https://lists.debian.org/debian-lts-announce/2019/03/msg00043.htmlMailing ListThird Party Advisory
- https://security.netapp.com/advisory/ntap-20190502-0007/PatchThird Party Advisory
- https://usn.ubuntu.com/3922-1/Third Party Advisory
- https://usn.ubuntu.com/3922-2/Third Party Advisory
- https://usn.ubuntu.com/3922-3/Third Party Advisory
- https://www.debian.org/security/2019/dsa-4403Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00104.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00012.htmlMailing ListThird Party Advisory
FAQ
What is CVE-2019-9638?
CVE-2019-9638 is a vulnerability with a CVSS score of 7.5 (HIGH). An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling ...
How severe is CVE-2019-9638?
CVE-2019-9638 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-9638?
Check the references section above for vendor advisories and patch information. Affected products include: Php Php, Debian Debian Linux, Canonical Ubuntu Linux, Opensuse Leap, Netapp Storage Automation Store.