CVE-2019-11046 — Buffer underflow in bc_shift_addsub
In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, including Windows, can be tricked into reading beyond the alloc…
Published: 2019-12-23 · CVSS: 3.7 · CVSS 3.1
In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, including Windows, can be tricked into reading beyond the allocated space by supplying it with string containing characters that are identified as numeric by the OS but aren't ASCII numbers. This can read to disclosure of the content of some memory locations.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7