Vulnerability Description
An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an Invalid Read in exif_process_SOFn.
CVSS Score
7.5
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Php | Php | >= 7.1.0, < 7.1.27 |
| Canonical | Ubuntu Linux | 12.04 |
| Debian | Debian Linux | 8.0 |
| Opensuse | Leap | 15.0 |
| Netapp | Storage Automation Store | - |
| Redhat | Software Collections | 1.0 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00104.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00012.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.htmlMailing ListThird Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2519Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3299Third Party Advisory
- https://bugs.php.net/bug.php?id=77540ExploitIssue TrackingPatch
- https://lists.debian.org/debian-lts-announce/2019/03/msg00043.htmlMailing ListThird Party Advisory
- https://security.netapp.com/advisory/ntap-20190502-0007/PatchThird Party Advisory
- https://usn.ubuntu.com/3922-1/Third Party Advisory
- https://usn.ubuntu.com/3922-2/Third Party Advisory
- https://usn.ubuntu.com/3922-3/Third Party Advisory
- https://www.debian.org/security/2019/dsa-4403Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00104.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00012.htmlMailing ListThird Party Advisory
FAQ
What is CVE-2019-9640?
CVE-2019-9640 is a vulnerability with a CVSS score of 7.5 (HIGH). An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an Invalid Read in exif_process_SOFn.
How severe is CVE-2019-9640?
CVE-2019-9640 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-9640?
Check the references section above for vendor advisories and patch information. Affected products include: Php Php, Canonical Ubuntu Linux, Debian Debian Linux, Opensuse Leap, Netapp Storage Automation Store.