ISOMAN

CVE

CVE-2019-9022

An issue was discovered in PHP 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.2. dns_get_record misparses a DNS response, which can allow a hostile DNS server to cause PHP to misuse memcpy, leading to read operations going past the buffer allocated for DNS data. This affects php_parserr in ext/standard/dns.c for DNS_CAA and DNS_ANY queries.

Severity
HIGH
CVSS
7.5
Published
Modified
NVD detailAll CVEs

Linked Releases

DistributionReleaseStatusEvidence
Ubuntu16.04.7 amd64 desktopunknownsource
Ubuntu16.04.6 i386 desktopunknownsource
Ubuntu16.04.7 amd64 serverunknownsource
Ubuntu16.04.6 i386 serverunknownsource
Ubuntu14.04.6 amd64 desktopunknownsource
Ubuntu14.04.6 i386 desktopunknownsource
Ubuntu14.04.6 amd64 serverunknownsource
Ubuntu14.04.6 i386 serverunknownsource

References

  1. http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html
  2. http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html
  3. https://access.redhat.com/errata/RHSA-2019:2519
  4. https://access.redhat.com/errata/RHSA-2019:3299
  5. https://bugs.php.net/bug.php?id=77369
  6. https://lists.debian.org/debian-lts-announce/2019/03/msg00043.html
  7. https://security.netapp.com/advisory/ntap-20190321-0001/
  8. https://usn.ubuntu.com/3902-1/
  9. https://usn.ubuntu.com/3922-2/
  10. https://usn.ubuntu.com/3922-3/
  11. https://www.debian.org/security/2019/dsa-4398
  12. https://www.tenable.com/security/tns-2019-07
  13. http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html
  14. http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html
  15. https://access.redhat.com/errata/RHSA-2019:2519
  16. https://access.redhat.com/errata/RHSA-2019:3299
  17. https://bugs.php.net/bug.php?id=77369
  18. https://lists.debian.org/debian-lts-announce/2019/03/msg00043.html
  19. https://security.netapp.com/advisory/ntap-20190321-0001/
  20. https://usn.ubuntu.com/3902-1/