GD up to 7.1.29/7.2.18/7.3.5 EXIF Extension exif_read_data memory corruption

Summaryinfo

A vulnerability identified as critical has been detected in GD up to 7.1.29/7.2.18/7.3.5. The impacted element is the function exif_read_data of the component EXIF Extension. The manipulation leads to memory corruption. This vulnerability is traded as CVE-2019-11040. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in GD up to 7.1.29/7.2.18/7.3.5. This issue affects the function exif_read_data of the component EXIF Extension. The manipulation with an unknown input leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

When EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.

The weakness was shared 06/19/2019 (Website). The advisory is shared at bugs.php.net. The identification of this vulnerability is CVE-2019-11040 since 04/09/2019. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available.

The commercial vulnerability scanner Qualys is able to test this issue with plugin 197487 (Ubuntu Security Notification for Php7.0, Php7.2 Vulnerabilities (USN-4009-1)).

Upgrading to version 7.1.30, 7.2.19 or 7.3.6 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 108177†). The entries VDB-131531, VDB-131532, VDB-131533 and VDB-131534 are related to this item. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• GD

Version

• 7.1.0
• 7.1.1
• 7.1.2
• 7.1.3
• 7.1.4
• 7.1.5
• 7.1.6
• 7.1.7
• 7.1.8
• 7.1.9
• 7.1.10
• 7.1.11
• 7.1.12
• 7.1.13
• 7.1.14
• 7.1.15
• 7.1.16
• 7.1.17
• 7.1.18
• 7.1.19
• 7.1.20
• 7.1.21
• 7.1.22
• 7.1.23
• 7.1.24
• 7.1.25
• 7.1.26
• 7.1.27
• 7.1.28
• 7.1.29
• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4
• 7.2.5
• 7.2.6
• 7.2.7
• 7.2.8
• 7.2.9
• 7.2.10
• 7.2.11
• 7.2.12
• 7.2.13
• 7.2.14
• 7.2.15
• 7.2.16
• 7.2.17
• 7.2.18
• 7.3.0
• 7.3.1
• 7.3.2
• 7.3.3
• 7.3.4
• 7.3.5

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion