CVE-2019-9641 — Vulnetix

CVE-2019-9641 PUBLISHED

An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_TIFF.

EPSS 52.08% · 98.0th percentile

Risk Scores

EPSS Score

52.08%

98.0th percentile

Affected Products

Vendor	Product	Versions
Ubuntu:16.04:LTS	php7.0	7.0.30-0ubuntu0.16.04.1, 7.0.33-0ubuntu0.16.04.1, 7.0.33-0ubuntu0.16.04.2
Ubuntu:18.04:LTS	php7.2	7.2.15-0ubuntu0.18.04.1, 7.2.1-1ubuntu2, 7.2.2-1ubuntu1
Ubuntu:14.04:LTS	php5	0, 5.5.3+dfsg-1ubuntu2, 5.5.3+dfsg-1ubuntu3

Exploit Intelligence

Tenda AC10 Router exploit stack-based buffer overflow (github-poc-repo)
Tenda AC10 Router exploit stack-based buffer overflow (github-poc-repo)
Tenda AC10 Router exploit stack-based buffer overflow (github-poc-repo)
Tenda AC10 Router exploit stack-based buffer overflow (github-poc-repo)
Tenda AC10 Router exploit stack-based buffer overflow (github-poc-repo)
Tenda AC10 Router exploit stack-based buffer overflow (github-poc-repo)
Tenda AC10 Router exploit stack-based buffer overflow (github-poc-repo)
Tenda AC10 Router exploit stack-based buffer overflow (github-poc-repo)
https://bugs.php.net/bug.php?id=77509 (nist-nvd)
Uninitialized read in exif_process_IFD_in_TIFF (hackerone)

…and 9 more exploits

Timeline

CVE Published
Oct 10, 2020 PoC Published
Apr 14, 2021 EPSS Score
Feb 4, 2022 EPSS Score
Mar 7, 2023 EPSS Score
Sep 7, 2024 EPSS Score
Mar 17, 2025 EPSS Score
Mar 29, 2025 EPSS Score
Apr 2, 2025 EPSS Score
May 1, 2025 EPSS Score
May 4, 2025 EPSS Score
May 18, 2025 EPSS Score

References

https://ubuntu.com/security/CVE-2019-9641 third-party-advisory
https://www.debian.org/security/2019/dsa-4403 third-party-advisory
https://ubuntu.com/security/notices/USN-3922-1 vendor-advisory
https://ubuntu.com/security/notices/USN-3922-2 vendor-advisory
https://ubuntu.com/security/notices/USN-3922-3 vendor-advisory
https://www.cve.org/CVERecord?id=CVE-2019-9641 third-party-advisory

Open in Interactive Console →