漏洞信息详情
PHP EXIF extension 缓冲区错误漏洞
- CNNVD编号：CNNVD-201905-104 <!--
- 危害等级： 超危-->
- 危害等级： 超危
- CVE编号： CVE-2019-11036
- 漏洞类型： 缓冲区错误
- 发布时间： 2019-05-03
- 威胁类型： 远程
- 更新时间： 2020-10-09
- 厂 商：
- 漏洞来源： Ubuntu,Red Hat,Sta...
-
漏洞简介
PHP（PHP：Hypertext Preprocessor，PHP：超文本预处理器）是PHPGroup和开放源代码社区的共同维护的一种开源的通用计算机脚本语言。该语言主要用于Web开发，支持多种数据库及操作系统。EXIF extension是其中的一个用于读取和编写图像元数据的扩展。
PHP EXIF extension 7.1.29之前的7.1.x版本、7.2.18之前的7.2.x版本和7.3.5之前的7.3.x版本中存在缓冲区错误漏洞。该漏洞源于网络系统或产品在内存上执行操作时，未正确验证数据边界，导致向关联的其他内存位置上执行了错误的读写操作。攻击者可利用该漏洞导致缓冲区溢出或堆溢出等。
漏洞公告
目前厂商已发布升级补丁以修复漏洞，补丁获取链接：
https://bugs.php.net/bug.php?id=77950
参考网址
来源:SUSE
链接:http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html
来源:FEDORA
链接:https://lists.fedoraproject.org/archives/list/[email protected]/message/2NFXYNCXZCPYT7ZN4ZLI5EPQQW44FRRO/
来源:BUGTRAQ
链接:https://seclists.org/bugtraq/2019/Sep/38
来源:MISC
链接:https://bugs.php.net/bug.php?id=77950
来源:REDHAT
链接:https://access.redhat.com/errata/RHSA-2019:2519
来源:DEBIAN
链接:https://www.debian.org/security/2019/dsa-4527
来源:www.php.net
链接:http://www.php.net/
来源:git.php.net
链接:http://git.php.net/?p=php-src.git;a=commit;h=f80ad18afae2230c2c1802c7d829100af646874e
来源:MLIST
链接:https://lists.debian.org/debian-lts-announce/2019/05/msg00035.html
来源:SUSE
链接:http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html
来源:FEDORA
链接:https://lists.fedoraproject.org/archives/list/[email protected]/message/WN2HLPGEZEF4MFM5YC5FILZB5QEQFP3A/
来源:SUSE
链接:http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00012.html
来源:DEBIAN
链接:https://www.debian.org/security/2019/dsa-4529
来源:BID
链接:http://www.securityfocus.com/bid/108177
来源:REDHAT
链接:https://access.redhat.com/errata/RHSA-2019:3299
来源:FEDORA
链接:https://lists.fedoraproject.org/archives/list/[email protected]/message/3BY2XUUAN277LS7HKAOGL4DVGAELOJV3/
来源:BID
链接:https://www.securityfocus.com/bid/108177
来源:UBUNTU
链接:https://usn.ubuntu.com/3566-2/
来源:SUSE
链接:http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00010.html
来源:UBUNTU
链接:https://usn.ubuntu.com/4009-1/
来源:CONFIRM
链接:https://security.netapp.com/advisory/ntap-20190517-0003/
来源:BUGTRAQ
链接:https://seclists.org/bugtraq/2019/Sep/35
来源:access.redhat.com
链接:https://access.redhat.com/errata/RHSA-2019:3299
来源:access.redhat.com
链接:https://access.redhat.com/errata/RHSA-2019:3300
来源:usn.ubuntu.com
链接:https://usn.ubuntu.com/3566-2/
来源:usn.ubuntu.com
链接:https://usn.ubuntu.com/4009-2/
来源:usn.ubuntu.com
链接:https://usn.ubuntu.com/4009-1/
来源:www.suse.com
链接:https://www.suse.com/support/update/announcement/2019/suse-su-20191365-1.html
来源:www.suse.com
链接:https://www.suse.com/support/update/announcement/2019/suse-su-20191461-1.html
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/ESB-2019.1873/
来源:www.ibm.com
链接:https://www.ibm.com/blogs/psirt/security-bulletin-api-connects-developer-portal-is-impacted-by-vulnerabilities-in-php/
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/ESB-2020.1500/
来源:nvd.nist.gov
链接:https://nvd.nist.gov/vuln/detail/CVE-2019-11036
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/ESB-2019.2019/
来源:packetstormsecurity.com
链接:https://packetstormsecurity.com/files/153001/Ubuntu-Security-Notice-USN-3566-2.html
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/ESB-2019.1838/
来源:packetstormsecurity.com
链接:https://packetstormsecurity.com/files/157463/Red-Hat-Security-Advisory-2020-1624-01.html
来源:www.securityfocus.com
链接:https://www.securityfocus.com/bid/108177
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/ESB-2019.2087/
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/ESB-2019.1920/
受影响实体
暂无
补丁
- PHP EXIF extension 缓冲区错误漏洞的修复措施<!--2019-5-3-->
还没有评论，来说两句吧...