CVE-2019-9022: An issue was discovered in PHP 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.2

Description

An issue was discovered in PHP 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.2. dns_get_record misparses a DNS response, which can allow a hostile DNS server to cause PHP to misuse memcpy, leading to read operations going past the buffer allocated for DNS data. This affects php_parserr in ext/standard/dns.c for DNS_CAA and DNS_ANY queries.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)4.2% · higher than 91% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

PH

PHP · PHP

7.0.0 before 7.1.26; 7.2.0 before 7.2.14; 7.3.0 before 7.3.2 · source: NVD

DL

Debian Linux · Debian

8.0; 9.0 · source: NVD

SA

Storage Automation Store · Netapp

All versions, or not specified · source: NVD

UL

Ubuntu Linux · Canonical

12.04; 14.04; 16.04 · source: NVD