Vulnerability Description
An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_TIFF.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Php | Php | < 7.1.27 |
| Debian | Debian Linux | 8.0 |
| Canonical | Ubuntu Linux | 12.04 |
| Opensuse | Leap | 15.0 |
| Netapp | Storage Automation Store | - |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00083.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00104.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.htmlMailing ListThird Party Advisory
- https://bugs.php.net/bug.php?id=77509ExploitIssue TrackingPatch
- https://lists.debian.org/debian-lts-announce/2019/03/msg00043.htmlMailing ListThird Party Advisory
- https://security.netapp.com/advisory/ntap-20190502-0007/PatchThird Party Advisory
- https://usn.ubuntu.com/3922-1/Third Party Advisory
- https://usn.ubuntu.com/3922-2/Third Party Advisory
- https://usn.ubuntu.com/3922-3/Third Party Advisory
- https://www.debian.org/security/2019/dsa-4403Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00083.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00104.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.htmlMailing ListThird Party Advisory
FAQ
What is CVE-2019-9641?
CVE-2019-9641 is a vulnerability with a CVSS score of 9.8 (CRITICAL). An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_TIFF.
How severe is CVE-2019-9641?
CVE-2019-9641 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2019-9641?
Check the references section above for vendor advisories and patch information. Affected products include: Php Php, Debian Debian Linux, Canonical Ubuntu Linux, Opensuse Leap, Netapp Storage Automation Store.