VDB

CVE-2019-9021

CVE-2019-9021 PUBLISHED

Reported by mitre · Published February 22, 2019

An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A heap-based buffer over-read in PHAR reading functions in the PHAR extension may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse the file name, a different vulnerability than CVE-2018-20783. This is related to phar_detect_phar_fname_ext in ext/phar/phar.c.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
php7Alpine7.2.17-r0, 7.2.14-r0
phpphp7.3.1, 7.2.14, 7.1.26, 5.6.40
php5Ubuntu:14.04:LTS5.5.9+dfsg-1ubuntu4.27

Affected products

VendorProductVersions
n/an/an/a
alpinephp70, 0
n/an/a*

Timeline

  • Feb 22, 2019 CVE Published
  • Oct 10, 2020 PoC Published (2 in total, the first dated here)
  • Apr 14, 2021 EPSS Score (30 in total, the first dated here)
  • Mar 6, 2026 Distribution Patch (5 in total, the first dated here)
  • Mar 6, 2026 Security Advisory (12 in total, the first dated here)
  • Sep 7, 2026 Coalition ESS Score

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2019-9021
vulnetix vdb fixes CVE-2019-9021

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2019-9021/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›