VULNERABILITY INTELLIGENCE
CVE-2019-11046
CVSS score3.7 LOW
EPSS probability4.12%
CISA KEVNot currently listed
Published2019-12-23
Last modified2026-08-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Description
In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, including Windows, can be tricked into reading beyond the allocated space by supplying it with string containing characters that are identified as numeric by the OS but aren't ASCII numbers. This can read to disclosure of the content of some memory locations.
Weakness classification
- CWE-125: Out-of-bounds Read
Primary references
- security@php.net — Third Party Advisory
- security@php.net — Mailing List, Patch, Vendor Advisory
- security@php.net — Mailing List, Third Party Advisory
- security@php.net
- security@php.net
- security@php.net — Mailing List, Third Party Advisory
- security@php.net — Mailing List, Third Party Advisory
- security@php.net — Mailing List, Third Party Advisory
- security@php.net — Third Party Advisory
- security@php.net
- security@php.net — Third Party Advisory
- security@php.net — Third Party Advisory