CVE-2019-9022

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-9022
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-9022.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-9022
Downstream
ALPINE (1)
ALSA (1)
CLSA (1)
DLA (1)
DSA (1)
openSUSE (4)
RHSA (3)
RLSA (1)
SUSE (3)
UBUNTU (1)
Related
ALSA (1)
openSUSE (4)
SUSE (3)
Published
2019-02-22T23:29:00Z
Modified
2026-10-24T10:30:15Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

An issue was discovered in PHP 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.2. dns_get_record misparses a DNS response, which can allow a hostile DNS server to cause PHP to misuse memcpy, leading to read operations going past the buffer allocated for DNS data. This affects php_parserr in ext/standard/dns.c for DNS_CAA and DNS_ANY queries.

Database specific 
{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*"
            ],
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "12.04"
                        },
                        {
                            "last_affected": "12.04"
                        },
                        {
                            "introduced": "14.04"
                        },
                        {
                            "last_affected": "14.04"
                        },
                        {
                            "introduced": "16.04"
                        },
                        {
                            "last_affected": "16.04"
                        }
                    ],
                    "source": "CPE_STRING"
                }
            ],
            "vendor_product": "canonical:ubuntu_linux"
        },
        {
            "cpes": [
                "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "8.0"
                        },
                        {
                            "last_affected": "8.0"
                        },
                        {
                            "introduced": "9.0"
                        },
                        {
                            "last_affected": "9.0"
                        }
                    ],
                    "source": "CPE_STRING"
                }
            ],
            "vendor_product": "debian:debian_linux"
        }
    ]
}
References

Affected packages

Git / github.com/php/php-src

Affected ranges

Type
GIT
Repo
https://github.com/php/php-src
Events
Introduced
60fffd296abce5fc071f3c173c25a2696cf683c6
Fixed
b3ad2be890e86c69cdc661739c74b677b46a53cb
Introduced
8148cbb78841c8ec0759c0836e7f35dec799d300
Fixed
643a161a24e662fd2afa9bf3591b105f4881e93e
Introduced
52ace952a1b65ca80fc2617f11c2fa6dd03f51bd
Fixed
3fa88e0ce0ffd9f63672afe114158a07a0204e21
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "7.0.0"
                },
                {
                    "fixed": "7.1.26"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "7.2.0"
                },
                {
                    "fixed": "7.2.14"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "7.3.0"
                },
                {
                    "fixed": "7.3.2"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-9022.json"