CVE ID:	CVE-2019-11046
Description:	In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, including Windows, can be tricked into reading beyond the allocated space by supplying it with string containing characters that are identified as numeric by the OS but aren't ASCII numbers. This can read to disclosure of the content of some memory locations.
Test IDs:	None available
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2019-11046 Bugtraq: 20200218 [SECURITY] [DSA 4626-1] php7.3 security update (Google Search) https://seclists.org/bugtraq/2020/Feb/27 Bugtraq: 20200219 [SECURITY] [DSA 4628-1] php7.0 security update (Google Search) https://seclists.org/bugtraq/2020/Feb/31 Bugtraq: 20210116 Re: [SECURITY] [DSA 4628-1] php7.0 security update (Google Search) https://seclists.org/bugtraq/2021/Jan/3 Debian Security Information: DSA-4626 (Google Search) https://www.debian.org/security/2020/dsa-4626 Debian Security Information: DSA-4628 (Google Search) https://www.debian.org/security/2020/dsa-4628 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/ https://bugs.php.net/bug.php?id=78878 https://lists.debian.org/debian-lts-announce/2019/12/msg00034.html SuSE Security Announcement: openSUSE-SU-2020:0080 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00036.html https://usn.ubuntu.com/4239-1/