CVE-2019-11039

Function iconv_mime_decode_headers() in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 may perform out-of-buffer read due to integer overflow when parsing MIME headers. This may lead to information disclosure or crash.

Score

CVSS 3.1 9.1 Critical

Status

Modified - security@php.net

Published

2019-06-19

Last modified

2024-09-17

Weaknesses

CWE-125, CWE-190

Affected products

• Debian Linux (Debian)
• Leap (Opensuse)
• Php (Php)
• Php (Php Group)
• Software Collections (Redhat)

References

• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00029.html
• https://access.redhat.com/errata/RHSA-2019:2519
• https://access.redhat.com/errata/RHSA-2019:3299
• https://bugs.php.net/bug.php?id=78069
• https://seclists.org/bugtraq/2019/Sep/35
• https://seclists.org/bugtraq/2019/Sep/38
• https://www.debian.org/security/2019/dsa-4527
• https://www.debian.org/security/2019/dsa-4529