CVE-2019-9640

An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3 (CVE-2019-9640)

Description

An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an Invalid Read in exif_process_SOFn.

Source: NVD CVELISTV5

Metrics

Severity

high

93.32

—

no public PoC known

7.5

Source: nvd-v3

CVSS v3

7.5

CVSS v4

—

EPSS percentile

93.1 %

Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).

EPSS score

6.2 %

Moderate — model estimates 1-10% exploitation likelihood.

Published

2019-03-08 23:00 UTC

CWE

—

Affected operating systems

linux
debian / debian_linux8.0
linux
debian / debian_linux9.0
linux
opensuse / leap15.0
linux
opensuse / leap15.1
linux
opensuse / leap42.3
linux
canonical / ubuntu_linux12.04
linux
canonical / ubuntu_linux14.04
linux
canonical / ubuntu_linux16.04
linux
canonical / ubuntu_linux18.04
linux
canonical / ubuntu_linux18.10

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

netapp
storage_automation_store
php
php7.1.0 – 7.1.27
php
php7.2.0 – 7.2.16
php
php7.3.0 – 7.3.3
redhat
software_collections

References & sources

IDCVE-2019-9640