CVE-2019-11046

In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, including Windows, can be tricked into reading beyond the allocated space by supplying it with string containing characters that are identified as numeric by the OS but aren't ASCII numbers. This can read to disclosure of the content of some memory locations.

CVSS v3 3.7 LOW
CVSS v2.0 5.0 MEDIUM

3.7^/10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00036.html	Third Party Advisory
https://bugs.php.net/bug.php?id=78878	Mailing List Patch Vendor Advisory
https://lists.debian.org/debian-lts-announce/2019/12/msg00034.html	Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/
https://seclists.org/bugtraq/2020/Feb/27	Mailing List Third Party Advisory
https://seclists.org/bugtraq/2020/Feb/31	Mailing List Third Party Advisory
https://seclists.org/bugtraq/2021/Jan/3	Mailing List Third Party Advisory
https://security.netapp.com/advisory/ntap-20200103-0002/	Third Party Advisory
https://support.f5.com/csp/article/K48866433?utm_source=f5support&amp%3Butm_medium=RSS
https://usn.ubuntu.com/4239-1/	Third Party Advisory
https://www.debian.org/security/2020/dsa-4626	Third Party Advisory
https://www.debian.org/security/2020/dsa-4628	Third Party Advisory
https://www.tenable.com/security/tns-2021-14	Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00036.html	Third Party Advisory
https://bugs.php.net/bug.php?id=78878	Mailing List Patch Vendor Advisory
https://lists.debian.org/debian-lts-announce/2019/12/msg00034.html	Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/
https://seclists.org/bugtraq/2020/Feb/27	Mailing List Third Party Advisory
https://seclists.org/bugtraq/2020/Feb/31	Mailing List Third Party Advisory
https://seclists.org/bugtraq/2021/Jan/3	Mailing List Third Party Advisory
https://security.netapp.com/advisory/ntap-20200103-0002/	Third Party Advisory
https://support.f5.com/csp/article/K48866433?utm_source=f5support&amp%3Butm_medium=RSS
https://usn.ubuntu.com/4239-1/	Third Party Advisory
https://www.debian.org/security/2020/dsa-4626	Third Party Advisory
https://www.debian.org/security/2020/dsa-4628	Third Party Advisory
https://www.tenable.com/security/tns-2021-14	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:php:php::::::::
	cpe:2.3:a:php:php::::::::
	cpe:2.3:a:php:php:7.4.0:::::::*

Configuration 2 (hide)

OR	cpe:2.3:o:debian:debian_linux:8.0:::::::*
	cpe:2.3:o:debian:debian_linux:9.0:::::::*
	cpe:2.3:o:debian:debian_linux:10.0:::::::*

Configuration 3 (hide)

OR	cpe:2.3:o:fedoraproject:fedora:30:::::::*
	cpe:2.3:o:fedoraproject:fedora:31:::::::*

Configuration 4 (hide)

cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

Configuration 5 (hide)

OR	cpe:2.3:o:canonical:ubuntu_linux:12.04::::-:::
	cpe:2.3:o:canonical:ubuntu_linux:14.04::::esm:::
	cpe:2.3:o:canonical:ubuntu_linux:16.04::::esm:::
	cpe:2.3:o:canonical:ubuntu_linux:18.04::::lts:::
	cpe:2.3:o:canonical:ubuntu_linux:19.04:::::::*
	cpe:2.3:o:canonical:ubuntu_linux:19.10:::::::*

Configuration 6 (hide)

cpe:2.3:a:tenable:securitycenter:*:*:*:*:*:*:*:*

History

21 Nov 2024, 04:20

Information

Published : 2019-12-23 03:15

Updated : 2024-11-21 04:20

NVD link : CVE-2019-11046

Mitre link : CVE-2019-11046

CVE.ORG link : CVE-2019-11046

JSON object : View

Products Affected

debian

debian_linux

fedoraproject

fedora

canonical

ubuntu_linux

php

opensuse

leap

tenable

securitycenter

CWE

CWE-125

Out-of-bounds Read

{"id": "CVE-2019-11046", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "security@php.net", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2019-12-23T03:15:11.710", "references": [{"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00036.html", "tags": ["Third Party Advisory"], "source": "security@php.net"}, {"url": "https://bugs.php.net/bug.php?id=78878", "tags": ["Mailing List", "Patch", "Vendor Advisory"], "source": "security@php.net"}, {"url": "https://lists.debian.org/debian-lts-announce/2019/12/msg00034.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "security@php.net"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/", "source": "security@php.net"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/", "source": "security@php.net"}, {"url": "https://seclists.org/bugtraq/2020/Feb/27", "tags": ["Mailing List", "Third Party Advisory"], "source": "security@php.net"}, {"url": "https://seclists.org/bugtraq/2020/Feb/31", "tags": ["Mailing List", "Third Party Advisory"], "source": "security@php.net"}, {"url": "https://seclists.org/bugtraq/2021/Jan/3", "tags": ["Mailing List", "Third Party Advisory"], "source": "security@php.net"}, {"url": "https://security.netapp.com/advisory/ntap-20200103-0002/", "tags": ["Third Party Advisory"], "source": "security@php.net"}, {"url": "https://support.f5.com/csp/article/K48866433?utm_source=f5support&amp%3Butm_medium=RSS", "source": "security@php.net"}, {"url": "https://usn.ubuntu.com/4239-1/", "tags": ["Third Party Advisory"], "source": "security@php.net"}, {"url": "https://www.debian.org/security/2020/dsa-4626", "tags": ["Third Party Advisory"], "source": "security@php.net"}, {"url": "https://www.debian.org/security/2020/dsa-4628", "tags": ["Third Party Advisory"], "source": "security@php.net"}, {"url": "https://www.tenable.com/security/tns-2021-14", "tags": ["Third Party Advisory"], "source": "security@php.net"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00036.html", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://bugs.php.net/bug.php?id=78878", "tags": ["Mailing List", "Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.debian.org/debian-lts-announce/2019/12/msg00034.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://seclists.org/bugtraq/2020/Feb/27", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://seclists.org/bugtraq/2020/Feb/31", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://seclists.org/bugtraq/2021/Jan/3", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.netapp.com/advisory/ntap-20200103-0002/", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://support.f5.com/csp/article/K48866433?utm_source=f5support&amp%3Butm_medium=RSS", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://usn.ubuntu.com/4239-1/", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.debian.org/security/2020/dsa-4626", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.debian.org/security/2020/dsa-4628", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.tenable.com/security/tns-2021-14", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@php.net", "description": [{"lang": "en", "value": "CWE-125"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, including Windows, can be tricked into reading beyond the allocated space by supplying it with string containing characters that are identified as numeric by the OS but aren't ASCII numbers. This can read to disclosure of the content of some memory locations."}, {"lang": "es", "value": "En PHP versiones 7.2.x por debajo de 7.2.26, versiones 7.3.x por debajo de 7.3.13 y 7.4.0, las funciones de extensi\u00f3n bcmath de PHP en algunos sistemas, incluyendo Windows, pueden ser enga\u00f1adas para que lean m\u00e1s all\u00e1 del espacio asignado al suministrarle cadenas que contengan caracteres que el sistema operativo identifica como num\u00e9ricos pero no son n\u00fameros ASCII. Esto puede ser le\u00eddo para revelar el contenido de algunas ubicaciones de memoria."}], "lastModified": "2024-11-21T04:20:26.563", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CA273A0A-9438-40CA-8DD9-E97FADE3BBF7", "versionEndIncluding": "7.2.26", "versionStartIncluding": "7.2.0"}, {"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2083CFF8-5F24-46C7-AA69-F8AE86874E70", "versionEndIncluding": "7.3.13", "versionStartIncluding": "7.3.0"}, {"criteria": "cpe:2.3:a:php:php:7.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DB281E6F-3CB5-49C4-B62C-307AEA35AE56"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"}, {"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252"}, {"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "97A4B8DF-58DA-4AB6-A1F9-331B36409BA3"}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "80F0FA5D-8D3B-4C0E-81E2-87998286AF33"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "CB66DB75-2B16-4EBF-9B93-CE49D8086E41"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*", "vulnerable": true, "matchCriteriaId": "815D70A8-47D3-459C-A32C-9FEACA0659D1"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*", "vulnerable": true, "matchCriteriaId": "7A5301BF-1402-4BE0-A0F8-69FBE79BC6D6"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CD783B0C-9246-47D9-A937-6144FE8BFF0F"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A31C8344-3E02-4EB8-8BD8-4C84B7959624"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tenable:securitycenter:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FFDEC754-9E4C-4FCE-8B91-0FAB7CBC4BA1", "versionEndExcluding": "5.19.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@php.net"}

3.7 /10

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0 /10

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

JSON object

Attach tags to CVE-2019-11046

3.7^/10

5.0^/10

Attach tags to `CVE-2019-11046`