CVE-2019-11039critical
New! CVE Severity Now Using CVSS v3
The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Description
Function iconv_mime_decode_headers() in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 may perform out-of-buffer read due to integer overflow when parsing MIME headers. This may lead to information disclosure or crash.
References
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00029.html
https://access.redhat.com/errata/RHSA-2019:2519
https://access.redhat.com/errata/RHSA-2019:3299
https://bugs.php.net/bug.php?id=78069
https://seclists.org/bugtraq/2019/Sep/35
https://seclists.org/bugtraq/2019/Sep/38
Details
Source: MITRE
Published: 2019-06-19
Updated: 2020-10-16
Type: CWE-190
Risk Information
CVSS v2
Base Score: 6.4
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:P
Impact Score: 4.9
Exploitability Score: 10
Severity: MEDIUM
CVSS v3
Base Score: 9.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Impact Score: 5.2
Exploitability Score: 3.9
Severity: CRITICAL
Vulnerable Software
Configuration 1
OR
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Configuration 2
OR
Configuration 3
OR
Configuration 4
OR
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 145957 | CentOS 8 : php:7.3 (CESA-2020:3662) | Nessus | CentOS Local Security Checks | critical |
| 145814 | CentOS 8 : php:7.2 (CESA-2020:1624) | Nessus | CentOS Local Security Checks | critical |
| 142352 | EulerOS 2.0 SP2 : php (EulerOS-SA-2020-2384) | Nessus | Huawei Local Security Checks | critical |
| 140983 | EulerOS Virtualization for ARM 64 3.0.6.0 : php (EulerOS-SA-2020-2035) | Nessus | Huawei Local Security Checks | critical |
| 140834 | EulerOS 2.0 SP3 : php (EulerOS-SA-2020-2067) | Nessus | Huawei Local Security Checks | critical |
| 140482 | Oracle Linux 8 : php:7.3 (ELSA-2020-3662) | Nessus | Oracle Linux Local Security Checks | critical |
| 140396 | RHEL 8 : php:7.3 (RHSA-2020:3662) | Nessus | Red Hat Local Security Checks | critical |
| 139977 | EulerOS 2.0 SP8 : php (EulerOS-SA-2020-1874) | Nessus | Huawei Local Security Checks | critical |
| 136057 | RHEL 8 : php:7.2 (RHSA-2020:1624) | Nessus | Red Hat Local Security Checks | critical |
| 129107 | Debian DSA-4529-1 : php7.0 - security update | Nessus | Debian Local Security Checks | critical |
| 129073 | Debian DSA-4527-1 : php7.3 - security update | Nessus | Debian Local Security Checks | critical |
| 127068 | Amazon Linux AMI : php71 / php72,php73 (ALAS-2019-1240) | Nessus | Amazon Linux Local Security Checks | critical |
| 126908 | openSUSE Security Update : php7 (openSUSE-2019-1778) | Nessus | SuSE Local Security Checks | critical |
| 126693 | SUSE SLED15 / SLES15 Security Update : php7 (SUSE-SU-2019:1832-1) | Nessus | SuSE Local Security Checks | critical |
| 126500 | SUSE SLES12 Security Update : php5 (SUSE-SU-2019:1746-1) | Nessus | SuSE Local Security Checks | critical |
| 126463 | SUSE SLES12 Security Update : php7 (SUSE-SU-2019:1725-1) | Nessus | SuSE Local Security Checks | critical |
| 126462 | SUSE SLES12 Security Update : php72 (SUSE-SU-2019:1724-1) | Nessus | SuSE Local Security Checks | critical |
| 98621 | PHP 7.1.x < 7.1.30 Multiple Vulnerabilities | Web Application Scanning | Component Vulnerability | critical |
| 98620 | PHP 7.2.x < 7.2.19 Multiple Vulnerabilities | Web Application Scanning | Component Vulnerability | critical |
| 98619 | PHP 7.3.x < 7.3.6 Multiple Vulnerabilities | Web Application Scanning | Component Vulnerability | critical |
| 125787 | Fedora 29 : php (2019-8c4b25b5ec) | Nessus | Fedora Local Security Checks | critical |
| 125769 | Ubuntu 16.04 LTS / 18.04 LTS / 18.10 / 19.04 : php7.0, php7.2 vulnerabilities (USN-4009-1) | Nessus | Ubuntu Local Security Checks | critical |
| 125747 | Fedora 30 : php (2019-be4f895015) | Nessus | Fedora Local Security Checks | critical |
| 125682 | Debian DLA-1813-1 : php5 security update | Nessus | Debian Local Security Checks | critical |
| 125681 | PHP 7.3.x < 7.3.6 Multiple Vulnerabilities. | Nessus | CGI abuses | critical |
| 125640 | PHP 7.1.x < 7.1.30 Multiple Vulnerabilities. | Nessus | CGI abuses | critical |
| 125639 | PHP 7.2.x < 7.2.19 Multiple Vulnerabilities. | Nessus | CGI abuses | critical |