ISOMAN

CVE

CVE-2019-9020

An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. Invalid input to the function xmlrpc_decode() can lead to an invalid memory access (heap out of bounds read or read after free). This is related to xml_elem_parse_buf in ext/xmlrpc/libxmlrpc/xml_element.c.

Severity
CRITICAL
CVSS
9.8
Published
Modified
NVD detailAll CVEs

Linked Releases

DistributionReleaseStatusEvidence
Ubuntu16.04.7 amd64 desktopunknownsource
Ubuntu16.04.6 i386 desktopunknownsource
Ubuntu16.04.7 amd64 serverunknownsource
Ubuntu16.04.6 i386 serverunknownsource
Ubuntu14.04.6 amd64 desktopunknownsource
Ubuntu14.04.6 i386 desktopunknownsource
Ubuntu14.04.6 amd64 serverunknownsource
Ubuntu14.04.6 i386 serverunknownsource

References

  1. http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00083.html
  2. http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00104.html
  3. http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html
  4. http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html
  5. http://www.securityfocus.com/bid/107156
  6. https://access.redhat.com/errata/RHSA-2019:2519
  7. https://access.redhat.com/errata/RHSA-2019:3299
  8. https://bugs.php.net/bug.php?id=77242
  9. https://bugs.php.net/bug.php?id=77249
  10. https://security.netapp.com/advisory/ntap-20190321-0001/
  11. https://usn.ubuntu.com/3902-1/
  12. https://usn.ubuntu.com/3902-2/
  13. https://www.debian.org/security/2019/dsa-4398
  14. http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00083.html
  15. http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00104.html
  16. http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html
  17. http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html
  18. http://www.securityfocus.com/bid/107156
  19. https://access.redhat.com/errata/RHSA-2019:2519
  20. https://access.redhat.com/errata/RHSA-2019:3299