peter bassill · operator
$ cve CVE-2019-11035 JSON

CVE-2019-11035

9.1
CRITICAL · CVSS 3.1 · EPSS 4.4% (pctl 91)

In your normal cycle

Critical by CVSS (9.1), but no sign of active exploitation.

Description

When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_iif_add_value function. This may lead to information disclosure or crash.

Scoring

CVSS9.1 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
EPSS4.41% — more likely to be exploited than 91% of all CVEs
WeaknessCWE-125
On CISA KEVno
Public exploitnone known
Published2019-04-18
Last modified2026-06-17

Affected (6)

VendorProduct
canonicalubuntu linux
debiandebian linux
netappstorage automation store
opensuseleap
phpphp
redhatsoftware collections

References

→ the Explorer  ·  watch your stack  ·  NVD