Your message dated Fri, 31 May 2019 22:10:13 +0200
with message-id <[email protected]>
and subject line Re: Bug#928421: php7.3: CVE-2019-11036
has caused the Debian Bug report #928421,
regarding php7.3: CVE-2019-11036
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
928421: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=928421
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: php7.3
Version: 7.3.4-2
Severity: important
Tags: security upstream
Forwarded: https://bugs.php.net/bug.php?id=77950
Hi,
The following vulnerability was published for php7.3.
CVE-2019-11036[0]:
| When processing certain files, PHP EXIF extension in versions 7.1.x
| below 7.1.29, 7.2.x below 7.2.18 and 7.3.x below 7.3.5 can be caused
| to read past allocated buffer in exif_process_IFD_TAG function. This
| may lead to information disclosure or crash.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2019-11036
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11036
[1] https://bugs.php.net/bug.php?id=77950
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: php7.3
Source-Version: 7.3.6-1
On Sat, May 04, 2019 at 10:46:24AM +0200, Salvatore Bonaccorso wrote:
> Source: php7.3
> Version: 7.3.4-2
> Severity: important
> Tags: security upstream
> Forwarded: https://bugs.php.net/bug.php?id=77950
>
> Hi,
>
> The following vulnerability was published for php7.3.
>
> CVE-2019-11036[0]:
> | When processing certain files, PHP EXIF extension in versions 7.1.x
> | below 7.1.29, 7.2.x below 7.2.18 and 7.3.x below 7.3.5 can be caused
> | to read past allocated buffer in exif_process_IFD_TAG function. This
> | may lead to information disclosure or crash.
This issue was fixed upstream in 7.3.5 and thus included in the
7.3.6-1 upload to unstable, but it was not closed with the upload.
Regards,
Salvatore
--- End Message ---
