cve/2019/CVE-2019-11035.md

### [CVE-2019-11035](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11035)
![](https://img.shields.io/static/v1?label=Product&message=PHP&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=7.1.x%3C%207.1.28%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-125%20Out-of-bounds%20Read&color=brighgreen)

### Description

When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_iif_add_value function. This may lead to information disclosure or crash.

### POC

#### Reference
- https://usn.ubuntu.com/3953-2/
- https://usn.ubuntu.com/3953-2/

#### Github
No PoCs found on GitHub currently.