CVSS: 9.8EPSS: 3%CPEs: 14EXPL: 2CVE-2019-9641
https://notcve.org/view.php?id=CVE-2019-9641
An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_TIFF. Se ha detectado un fallo en el componente EXIF en PHP, en versiones anteriores a la 7.1.27, en las 7.2.x anteriores a la 7.2.16 y en las 7.3.x anteriores a la 7.3.3. Hay una lectura no inicializada en exif_process_IFD_in_TIFF. • https://github.com/Schnaidr/CVE-2019-9641-php-RCE http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00083.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00104.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html https://bugs.php.net/bug.php?id=77509 https://lists.debian.org/debian-lts-announce/2019/03/msg00043.html https://security.netapp.com/advisory/ • CWE-908: Use of Uninitialized Resource •
CVSS: 7.5EPSS: 0%CPEs: 12EXPL: 0CVE-2019-9637 – php: File rename across filesystems may allow unwanted access during processing
https://notcve.org/view.php?id=CVE-2019-9637
An issue was discovered in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. Due to the way rename() across filesystems is implemented, it is possible that file being renamed is briefly available with wrong permissions while the rename is ongoing, thus enabling unauthorized users to access the data. Se ha detectado un fallo en PHP en versiones anteriores a la 7.1.27, en las 7.2.x anteriores a la 7.2.16 y en las 7.3.x anteriores a la 7.3.3. Debido a la manera en la que "rename()" se implementa en los sistemas de archivos es posible que el archivo que se está renombrado esté brevemente disponible con los permisos incorrectos mientras que dicho proceso siga en curso, habilitando el acceso a los datos a usuarios no autenticados. • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00104.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00012.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html https://access.redhat.com/errata/RHSA-2019:2519 https://access.redhat.com/errata/RHSA-2019:3299 https://bugs.php.net/bug.php?id=77630 https://lists.debian.org/debian-lts-announce/2019/03/msg0 • CWE-264: Permissions, Privileges, and Access Controls CWE-266: Incorrect Privilege Assignment •
CVSS: 7.5EPSS: 0%CPEs: 15EXPL: 1CVE-2019-9638 – php: Uninitialized read in exif_process_IFD_in_MAKERNOTE
https://notcve.org/view.php?id=CVE-2019-9638
An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling the maker_note->offset relationship to value_len. Se ha detectado un fallo en el componente EXIF en PHP, en versiones anteriores a la 7.1.27, en las 7.2.x anteriores a la 7.2.16 y en las 7.3.x anteriores a la 7.3.3. Hay una lectura no inicializada en exif_process_IFD_in_MAKERNOTE debido a la mala gestión de maker_note->offset relationship en value_len. • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00104.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00012.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html https://access.redhat.com/errata/RHSA-2019:2519 https://access.redhat.com/errata/RHSA-2019:3299 https://bugs.php.net/bug.php?id=77563 https://lists.debian.org/debian-lts-announce/2019/03/msg0 • CWE-125: Out-of-bounds Read CWE-665: Improper Initialization •
CVSS: 7.5EPSS: 0%CPEs: 15EXPL: 1CVE-2019-9639 – php: Uninitialized read in exif_process_IFD_in_MAKERNOTE
https://notcve.org/view.php?id=CVE-2019-9639
An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling the data_len variable. Se ha detectado un fallo en el componente EXIF en PHP, en versiones anteriores a la 7.1.27, en las 7.2.x anteriores a la 7.2.16 y en las 7.3.x anteriores a la 7.3.3. Hay una lectura no inicializada en exif_process_IFD_in_MAKERNOTE debido a la mala gestión de la variable data_len. • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00104.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00012.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html https://access.redhat.com/errata/RHSA-2019:2519 https://access.redhat.com/errata/RHSA-2019:3299 https://bugs.php.net/bug.php?id=77659 https://lists.debian.org/debian-lts-announce/2019/03/msg0 • CWE-665: Improper Initialization CWE-908: Use of Uninitialized Resource CWE-909: Missing Initialization of Resource •
CVSS: 9.8EPSS: 0%CPEs: 10EXPL: 2CVE-2019-9020 – php: Invalid memory access in function xmlrpc_decode()
https://notcve.org/view.php?id=CVE-2019-9020
An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. Invalid input to the function xmlrpc_decode() can lead to an invalid memory access (heap out of bounds read or read after free). This is related to xml_elem_parse_buf in ext/xmlrpc/libxmlrpc/xml_element.c. Se ha descubierto un problema en PHP en versiones anteriores a la 5.6.40, versiones 7.x anteriores a la 7.1.26, versiones 7.2.x anteriores a la 7.2.14 y versiones 7.3.x anteriores a la 7.3.1. Las entradas inválidas en la función xmlrpc_decode() pueden conducir a un acceso inválido a la memoria (lectura de memoria dinámica o heap fuera de límites o lectura de memoria previamente liberada). • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00083.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00104.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html http://www.securityfocus.com/bid/107156 https://access.redhat.com/errata/RHSA-2019:2519 https://access.redhat.com/errata/RHSA-2019:3299 https://bugs.php.net/bug.php?id=77242 https://bugs. • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read CWE-416: Use After Free •