CVE-2019-11050

Use-after-free in exif parsing under memory sanitizer

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.

We have discovered 248,640 live websites that are affected by CVE-2019-11050.

Run a Free Instant Scan



Affected Software

Product  PHP
Category Programming Languages
Vulnerable Domains248,640 live websites (3.59% of PHP install base)
Vulnerable Versions
  • from 7.2 through 7.2.26
  • from 7.3 through 7.3.13
  • from 7.4 through 7.4.1
Vulnerable Versions Count40 versions ( 7.56% of all versions)


Common Weakness Enumeration

CWE-125 Out-of-bounds Read



Details

  • Published - Dec 23, 2019
  • Updated - Sep 16, 2024

Credits

  • Submitted by Nikita Popov

Website Distribution by Country

Number of websites using CVE-2019-11050
United States84,594 websites


France103,260 websites
China7,790 websites
Russia6,411 websites
Germany4,734 websites
Poland4,315 websites
Netherlands4,116 websites
Italy3,301 websites
Japan2,934 websites
GB2,911 websites

Website Distribution by TLD

Number of websites using CVE-2019-11050
.com76,652 websites
.ru66,757 websites
.fr42,013 websites
.org6,777 websites
.net5,778 websites
.be5,193 websites
.pl4,194 websites
.it3,267 websites
.nl2,974 websites
.de2,662 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2019-11050

Top websites that are affected by CVE-2019-11050. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*.cn China*,***
*********.com China*,***
******.com China*,***
******.com France*,***
***.****.gov United States*,***
*****.**.com China*,***
*****.org United States*,***
*******.info France*,***
*********.com United States*,***
******.com France*,***
See full domain list

FAQ

CVE-2019-11050 is Out-of-bounds Read in PHP
A total of 248,640 websites have been identified as vulnerable to CVE-2019-11050, based on global website indexing conducted by WebTechSurvey.
The PHP is affected by the CVE-2019-11050 vulnerability.
PHP versions up to 7.4.1 are vulnerable to CVE-2019-11050.
CVE-2019-11050 is resolved in version 7.4.1 of PHP.

References