CVE-2019-11039

Function iconv_mime_decode_headers() in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 may perform out-of-buffer read due to integer overflow when parsing MIME headers. This may lead to information disclosure or crash.

CVSS v3.1

9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

CVSS v3.0

4.2 MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L

CVSS v2.0

6.4 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:P

EPSS

3.13% chance of exploitation in the next 30 days, 87th percentile

Published

2019-06-18

Updated

2024-09-17

Proof-of-concept exploits (1)

• https://bugs.php.net/bug.php?id=78069

References

• CVE Record
• NVD entry

Related

• CVE-2019-11038
• CVE-2019-11043
• CVE-2019-11026
• CVE-2019-11044
• CVE-2019-11024
• CVE-2019-11045