Skip to content
OpenAdvisories
High 1 exploited CVE RHSA-2019:3299 21 CVEs

Red Hat Security Advisory: rh-php72-php security update

Published Sep 13, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 30

ReleasePackageFixed in
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php72-php 0:7.2.24-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php72-php-bcmath 0:7.2.24-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php72-php-cli 0:7.2.24-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php72-php-common 0:7.2.24-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php72-php-dba 0:7.2.24-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php72-php-dbg 0:7.2.24-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php72-php-debuginfo 0:7.2.24-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php72-php-devel 0:7.2.24-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php72-php-embedded 0:7.2.24-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php72-php-enchant 0:7.2.24-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php72-php-fpm 0:7.2.24-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php72-php-gd 0:7.2.24-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php72-php-gmp 0:7.2.24-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php72-php-intl 0:7.2.24-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php72-php-json 0:7.2.24-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php72-php-ldap 0:7.2.24-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php72-php-mbstring 0:7.2.24-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php72-php-mysqlnd 0:7.2.24-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php72-php-odbc 0:7.2.24-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php72-php-opcache 0:7.2.24-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php72-php-pdo 0:7.2.24-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php72-php-pgsql 0:7.2.24-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php72-php-process 0:7.2.24-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php72-php-pspell 0:7.2.24-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php72-php-recode 0:7.2.24-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php72-php-snmp 0:7.2.24-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php72-php-soap 0:7.2.24-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php72-php-xml 0:7.2.24-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php72-php-xmlrpc 0:7.2.24-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7 rh-php72-php-zip 0:7.2.24-1.el7

Vulnerabilities 21

  • High 8.7
    CVE-2019-11043 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Underflow in PHP-FPM can lead to RCE

    In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibilit…

    PHP Group PHP php5 php7.0 Ubuntu Alpine
    KEV Mar 25, 2022
  • Medium 4.8
    CVE-2019-11034

    Heap over-read in PHP EXIF extension

    When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash.

    PHP Group PHP php5 php7.0 Ubuntu Alpine
  • Medium 4.8
    CVE-2019-11035

    Heap over-read in PHP EXIF extension

    When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_iif_add_value function. This may lead to information disclosure or crash.

    PHP Group PHP php5 php7.0 Ubuntu Alpine
  • Medium 4.8
    CVE-2019-11036

    Heap over-read in PHP EXIF extension

    When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.29, 7.2.x below 7.2.18 and 7.3.x below 7.3.5 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash.

    PHP Group PHP php5 php7.0 Ubuntu Alpine
  • Medium 4.8
    CVE-2019-11040

    Heap buffer overflow in EXIF extension

    When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 it is possible to supply it with data what will cause it to read past the alloc…

    PHP Group PHP php5 php7.0 Ubuntu Alpine
  • Medium 4.8
    CVE-2019-11041

    heap-buffer-overflow on exif_scan_thumbnail in EXIF extension

    When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the alloc…

    PHP Group PHP php5 php7.0 Ubuntu Alpine
  • Medium 4.8
    CVE-2019-11042

    heap-buffer-overflow on exif_process_user_comment in EXIF extension

    When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the alloc…

    PHP Group PHP php5 php7.0 Ubuntu Alpine
  • Medium 4.2
    CVE-2019-11039

    Out-of-bounds read in iconv.c

    Function iconv_mime_decode_headers() in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 may perform out-of-buffer read due to integer overflow when parsing MIME headers. This may lead to information disclosure or crash.

    PHP Group PHP php5 php7.0 Ubuntu Alpine
  • Low 3.1
    CVE-2019-11038

    Uninitialized read in gdImageCreateFromXbm

    When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the functi…

    PHP Group PHP php7 libgd2 Debian Ubuntu Alpine
  • Unscored —
    CVE-2016-10166 EPSS 11%

    Integer underflow in the _gdContributionsAlloc function in gd_interpolation.c in the GD Graphics Library (aka libgd) be…

    php7 libgd2 libgd2 gd Debian Ubuntu Alpine
  • Unscored —
    CVE-2018-20783

    In PHP before 5.6.39, 7.x before 7.0.33, 7.1.x before 7.1.25, and 7.2.x before 7.2.13, a buffer over-read in PHAR readi…

    php5 php7.0 php7.2 php7 Ubuntu Alpine
  • Unscored —
    CVE-2019-6977 Public exploit EPSS 71%

    gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch func…

    php7 libgd2 libgd2 gd Debian Ubuntu Alpine
  • Unscored —
    CVE-2019-9020 EPSS 10%

    An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. Invalid i…

    php5 php7.0 php7.2 php7 Ubuntu Alpine
  • Unscored —
    CVE-2019-9021 EPSS 10%

    An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A heap-ba…

    php5 php7.0 php7.2 php7 Ubuntu Alpine
  • Unscored —
    CVE-2019-9022

    An issue was discovered in PHP 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.2. dns_get_record misparses…

    php5 php7.0 php7.2 php7 Ubuntu Alpine
  • Unscored —
    CVE-2019-9023

    An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A number …

    php5 php7.0 php7.2 php7 Ubuntu Alpine
  • Unscored —
    CVE-2019-9024

    An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. xmlrpc_de…

    php5 php7.0 php7.2 php7 Ubuntu Alpine
  • Unscored —
    CVE-2019-9637

    An issue was discovered in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. Due to the way rename() acro…

    php5 php7.0 php7.2 php7 Ubuntu Alpine
  • Unscored —
    CVE-2019-9638

    An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There …

    php5 php7.0 php7.2 php7 Ubuntu Alpine
  • Unscored —
    CVE-2019-9639

    An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There …

    php5 php7.0 php7.2 php7 Ubuntu Alpine
  • Unscored —
    CVE-2019-9640

    An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There …

    php5 php7.0 php7.2 php7 Ubuntu Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#critical
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1418983
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1672207
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1680545
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1685123
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1685132
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1685398
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1685404
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1685412
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1688897
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1688922
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1688934
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1688939
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1702246
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1702256
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1707299
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1724149
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1724152
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1724154
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1739459
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1739465
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1766378
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3299.json
  • report
    https://access.redhat.com/security/cve/CVE-2016-10166
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-10166
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-10166
  • report
    https://access.redhat.com/security/cve/CVE-2018-20783
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-20783
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-20783
  • report
    https://access.redhat.com/security/cve/CVE-2019-6977
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-6977
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-6977
  • report
    https://access.redhat.com/security/cve/CVE-2019-9020
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-9020
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-9020
  • report
    https://access.redhat.com/security/cve/CVE-2019-9021
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-9021
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-9021
  • report
    https://access.redhat.com/security/cve/CVE-2019-9022