Skip to content
OpenAdvisories
Medium RHSA-2019:2519 33 CVEs

Red Hat Security Advisory: rh-php71-php security, bug fix, and enhancement update

Published Sep 13, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 30

ReleasePackageFixed in
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php71-php 0:7.1.30-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php71-php-bcmath 0:7.1.30-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php71-php-cli 0:7.1.30-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php71-php-common 0:7.1.30-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php71-php-dba 0:7.1.30-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php71-php-dbg 0:7.1.30-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php71-php-debuginfo 0:7.1.30-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php71-php-devel 0:7.1.30-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php71-php-embedded 0:7.1.30-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php71-php-enchant 0:7.1.30-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php71-php-fpm 0:7.1.30-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php71-php-gd 0:7.1.30-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php71-php-gmp 0:7.1.30-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php71-php-intl 0:7.1.30-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php71-php-json 0:7.1.30-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php71-php-ldap 0:7.1.30-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php71-php-mbstring 0:7.1.30-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php71-php-mysqlnd 0:7.1.30-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php71-php-odbc 0:7.1.30-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php71-php-opcache 0:7.1.30-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php71-php-pdo 0:7.1.30-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php71-php-pgsql 0:7.1.30-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php71-php-process 0:7.1.30-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php71-php-pspell 0:7.1.30-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php71-php-recode 0:7.1.30-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php71-php-snmp 0:7.1.30-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php71-php-soap 0:7.1.30-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php71-php-xml 0:7.1.30-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php71-php-xmlrpc 0:7.1.30-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php71-php-zip 0:7.1.30-1.el7

Vulnerabilities 33

  • Medium 4.8
    CVE-2019-11034

    Heap over-read in PHP EXIF extension

    When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash.

    PHP Group PHP php5 php7.0 Ubuntu Alpine
  • Medium 4.8
    CVE-2019-11035

    Heap over-read in PHP EXIF extension

    When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_iif_add_value function. This may lead to information disclosure or crash.

    PHP Group PHP php5 php7.0 Ubuntu Alpine
  • Medium 4.8
    CVE-2019-11036

    Heap over-read in PHP EXIF extension

    When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.29, 7.2.x below 7.2.18 and 7.3.x below 7.3.5 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash.

    PHP Group PHP php5 php7.0 Ubuntu Alpine
  • Medium 4.8
    CVE-2019-11040

    Heap buffer overflow in EXIF extension

    When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 it is possible to supply it with data what will cause it to read past the alloc…

    PHP Group PHP php5 php7.0 Ubuntu Alpine
  • Medium 4.2
    CVE-2019-11039

    Out-of-bounds read in iconv.c

    Function iconv_mime_decode_headers() in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 may perform out-of-buffer read due to integer overflow when parsing MIME headers. This may lead to information disclosure or crash.

    PHP Group PHP php5 php7.0 Ubuntu Alpine
  • Low 3.1
    CVE-2019-11038

    Uninitialized read in gdImageCreateFromXbm

    When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the functi…

    PHP Group PHP php7 libgd2 Debian Ubuntu Alpine
  • Unscored —
    CVE-2016-10166 EPSS 11%

    Integer underflow in the _gdContributionsAlloc function in gd_interpolation.c in the GD Graphics Library (aka libgd) be…

    php7 libgd2 libgd2 gd Debian Ubuntu Alpine
  • Unscored —
    CVE-2017-12932

    ext/standard/var_unserializer.re in PHP 7.0.x through 7.0.22 and 7.1.x through 7.1.8 is prone to a heap use after free …

    php7.0 Ubuntu
  • Unscored —
    CVE-2017-16642 Public exploit EPSS 26%

    In PHP before 5.6.32, 7.x before 7.0.25, and 7.1.x before 7.1.11, an error in the date extension's timelib_meridian han…

    php5 php7.0 Ubuntu
  • Unscored —
    CVE-2017-9118

    PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call.

    php5 php7.0 php7.2 php7.4 Ubuntu
  • Unscored —
    CVE-2017-9120

    PHP 7.x through 7.1.5 allows remote attackers to cause a denial of service (buffer overflow and application crash) or p…

    php5 php7.0 php7.2 php7.4 Ubuntu
  • Unscored —
    CVE-2018-10545

    An issue was discovered in PHP before 5.6.35, 7.0.x before 7.0.29, 7.1.x before 7.1.16, and 7.2.x before 7.2.4. Dumpabl…

    php5 php7.0 php7.2 php7 Ubuntu Alpine
  • Unscored —
    CVE-2018-10546 Public exploit

    An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. An infi…

    php5 php7.0 php7.2 php7 Ubuntu Alpine
  • Unscored —
    CVE-2018-10547

    An issue was discovered in ext/phar/phar_object.c in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7…

    php5 php7.0 php7.2 php7 Ubuntu Alpine
  • Unscored —
    CVE-2018-10548

    An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. ext/lda…

    php5 php7.0 php7.2 php7 Ubuntu Alpine
  • Unscored —
    CVE-2018-10549

    An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. exif_re…

    php7.0 php7.2 php7 Ubuntu Alpine
  • Unscored —
    CVE-2018-14851

    exif_process_IFD_in_MAKERNOTE in ext/exif/exif.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.…

    php5 php7.0 php7.2 php7 Ubuntu Alpine
  • Unscored —
    CVE-2018-14884

    An issue was discovered in PHP 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. Inappropriately parsin…

    php7 Alpine
  • Unscored —
    CVE-2018-17082 Scanner template

    The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XS…

    php5 php7.0 php7.2 php7 Ubuntu Alpine
  • Unscored —
    CVE-2018-20783

    In PHP before 5.6.39, 7.x before 7.0.33, 7.1.x before 7.1.25, and 7.2.x before 7.2.13, a buffer over-read in PHAR readi…

    php5 php7.0 php7.2 php7 Ubuntu Alpine
  • Unscored —
    CVE-2018-5711 Public exploit EPSS 13%

    gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1…

    php7 libgd2 libgd2 gd Debian Ubuntu Alpine
  • Unscored —
    CVE-2018-5712 EPSS 80%

    An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. There i…

    php5 php7.0 php7 php5 Ubuntu Alpine
  • Unscored —
    CVE-2018-7584 Public exploit EPSS 87%

    In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffe…

    php5 php7.0 php7.2 php7 Ubuntu Alpine
  • Unscored —
    CVE-2019-6977 Public exploit EPSS 71%

    gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch func…

    php7 libgd2 libgd2 gd Debian Ubuntu Alpine
  • Unscored —
    CVE-2019-9020 EPSS 10%

    An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. Invalid i…

    php5 php7.0 php7.2 php7 Ubuntu Alpine
  • Unscored —
    CVE-2019-9021 EPSS 10%

    An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A heap-ba…

    php5 php7.0 php7.2 php7 Ubuntu Alpine
  • Unscored —
    CVE-2019-9022

    An issue was discovered in PHP 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.2. dns_get_record misparses…

    php5 php7.0 php7.2 php7 Ubuntu Alpine
  • Unscored —
    CVE-2019-9023

    An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A number …

    php5 php7.0 php7.2 php7 Ubuntu Alpine
  • Unscored —
    CVE-2019-9024

    An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. xmlrpc_de…

    php5 php7.0 php7.2 php7 Ubuntu Alpine
  • Unscored —
    CVE-2019-9637

    An issue was discovered in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. Due to the way rename() acro…

    php5 php7.0 php7.2 php7 Ubuntu Alpine
  • Unscored —
    CVE-2019-9638

    An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There …

    php5 php7.0 php7.2 php7 Ubuntu Alpine
  • Unscored —
    CVE-2019-9639

    An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There …

    php5 php7.0 php7.2 php7 Ubuntu Alpine
  • Unscored —
    CVE-2019-9640

    An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There …

    php5 php7.0 php7.2 php7 Ubuntu Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1418983
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1484837
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1512057
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1535246
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1535251
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1551039
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1563858
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1573797
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1573802
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1573805
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1573814
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1609642
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1611890
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1611898
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1612362
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1629552
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1672207
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1680545
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1685123
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1685132
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1685398
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1685404
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1685412
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1688897
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1688922
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1688934
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1688939
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1702246
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1702256
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1707299
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1724149
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1724152
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1724154
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2519.json
  • report
    https://access.redhat.com/security/cve/CVE-2016-10166
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-10166
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-10166
  • report
    https://access.redhat.com/security/cve/CVE-2017-9118