Detections
Analytics
Alpine: php7: security update to 7.2.21-r0
critical Tenable Cloud Security Plugin ID 406324
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- Function iconv_mime_decode_headers() in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x
below 7.3.6 may perform out-of-buffer read due to integer overflow when parsing MIME headers. This may
lead to information disclosure or crash. (CVE-2019-11039)
- When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in
PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 it is possible to supply it with
data what will cause it to read past the allocated buffer. This may lead to information disclosure or
crash. (CVE-2019-11040)
- When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in
PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with
data what will cause it to read past the allocated buffer. This may lead to information disclosure or
crash. (CVE-2019-11041, CVE-2019-11042)
See Also
https://security.alpinelinux.org/vuln/CVE-2019-11039
https://security.alpinelinux.org/vuln/CVE-2019-11040
Plugin Details
Severity: Critical
ID: 406324
Version: Revision 1.25
Type: Local
Published: 10/31/2023
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 6.3
Percentile: 97.05
CVSS v2
Risk Factor: Medium
Base Score: 6.4
Temporal Score: 5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P
CVSS Score Source: CVE-2019-11040
CVSS v3
Risk Factor: Critical
Base Score: 9.1
Temporal Score: 8.2
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 5/7/2019
Reference Information
CVE: CVE-2019-11039, CVE-2019-11040, CVE-2019-11041, CVE-2019-11042
IAVA: 2019-A-0437-S
IAVB: 2019-B-0045-S, 2019-B-0070-S