CVSS: 8.1EPSS: 1%CPEs: 5EXPL: 0CVE-2019-9675
https://notcve.org/view.php?id=CVE-2019-9675
An issue was discovered in PHP 7.x before 7.1.27 and 7.3.x before 7.3.3. phar_tar_writeheaders_int in ext/phar/tar.c has a buffer overflow via a long link value. NOTE: The vendor indicates that the link value is used only when an archive contains a symlink, which currently cannot happen: "This issue allows theoretical compromise of security, but a practical attack is usually impossible. ** EN DISPUTA ** Se ha detectado un fallo en PHP, en las versiones 7.x anteriores a la 7.1.27 y en las 7.3.x anteriores a la 7.3.3. phar_tar_writeheaders_int tiene un desbordamiento de búfer mediante un valor de enlace largo. NOTA: el fabricante indica que el valor de enlace se utiliza solamente cuando un archivo contiene un symlink, algo que actualmente no puede ocurrir: "Este fallo facilita el compromiso teórico de la seguridad. Sin embargo, un ataque práctico es normalmente imposible." • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00104.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00012.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html http://php.net/ChangeLog-7.php https://bugs.php.net/bug.php?id=77586 https://usn.ubuntu.com/3922-2 https://usn.ubuntu.com/3922-3 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 0%CPEs: 15EXPL: 1CVE-2019-9638 – php: Uninitialized read in exif_process_IFD_in_MAKERNOTE
https://notcve.org/view.php?id=CVE-2019-9638
An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling the maker_note->offset relationship to value_len. Se ha detectado un fallo en el componente EXIF en PHP, en versiones anteriores a la 7.1.27, en las 7.2.x anteriores a la 7.2.16 y en las 7.3.x anteriores a la 7.3.3. Hay una lectura no inicializada en exif_process_IFD_in_MAKERNOTE debido a la mala gestión de maker_note->offset relationship en value_len. • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00104.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00012.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html https://access.redhat.com/errata/RHSA-2019:2519 https://access.redhat.com/errata/RHSA-2019:3299 https://bugs.php.net/bug.php?id=77563 https://lists.debian.org/debian-lts-announce/2019/03/msg0 • CWE-125: Out-of-bounds Read CWE-665: Improper Initialization •
CVSS: 7.5EPSS: 0%CPEs: 15EXPL: 1CVE-2019-9639 – php: Uninitialized read in exif_process_IFD_in_MAKERNOTE
https://notcve.org/view.php?id=CVE-2019-9639
An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling the data_len variable. Se ha detectado un fallo en el componente EXIF en PHP, en versiones anteriores a la 7.1.27, en las 7.2.x anteriores a la 7.2.16 y en las 7.3.x anteriores a la 7.3.3. Hay una lectura no inicializada en exif_process_IFD_in_MAKERNOTE debido a la mala gestión de la variable data_len. • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00104.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00012.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html https://access.redhat.com/errata/RHSA-2019:2519 https://access.redhat.com/errata/RHSA-2019:3299 https://bugs.php.net/bug.php?id=77659 https://lists.debian.org/debian-lts-announce/2019/03/msg0 • CWE-665: Improper Initialization CWE-908: Use of Uninitialized Resource CWE-909: Missing Initialization of Resource •
CVSS: 7.5EPSS: 0%CPEs: 15EXPL: 1CVE-2019-9640 – php: Invalid read in exif_process_SOFn()
https://notcve.org/view.php?id=CVE-2019-9640
An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an Invalid Read in exif_process_SOFn. Se ha detectado un fallo en el componente EXIF en PHP, en versiones anteriores a la 7.1.27, en las 7.2.x anteriores a la 7.2.16 y en las 7.3.x anteriores a la 7.3.3. Hay una lectura inválida en exif_process_SOFn. • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00104.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00012.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html https://access.redhat.com/errata/RHSA-2019:2519 https://access.redhat.com/errata/RHSA-2019:3299 https://bugs.php.net/bug.php?id=77540 https://lists.debian.org/debian-lts-announce/2019/03/msg0 • CWE-125: Out-of-bounds Read •
CVSS: 9.8EPSS: 3%CPEs: 14EXPL: 2CVE-2019-9641
https://notcve.org/view.php?id=CVE-2019-9641
An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_TIFF. Se ha detectado un fallo en el componente EXIF en PHP, en versiones anteriores a la 7.1.27, en las 7.2.x anteriores a la 7.2.16 y en las 7.3.x anteriores a la 7.3.3. Hay una lectura no inicializada en exif_process_IFD_in_TIFF. • https://github.com/Schnaidr/CVE-2019-9641-php-RCE http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00083.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00104.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html https://bugs.php.net/bug.php?id=77509 https://lists.debian.org/debian-lts-announce/2019/03/msg00043.html https://security.netapp.com/advisory/ • CWE-908: Use of Uninitialized Resource •