CVE-2016-4543

high-risk
Published 2016-05-22

The exif_process_IFD_in_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate IFD sizes, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.

Do I need to act?

~
5.4% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (20)

Php
Php
Php
Php
Php
Php
Php
Php
Php
Php
Php
Php
Php
Php
Php
Php
Php
Php
Php
Php

Affected Vendors

Php Fedoraproject Hp Opensuse

References (30)

Mailing List http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183736.html
http://lists.opensuse.org/opensuse-updates/2016-05/msg00086.html
Mailing List http://lists.opensuse.org/opensuse-updates/2016-06/msg00027.html
Patch http://php.net/ChangeLog-5.php
Patch http://php.net/ChangeLog-7.php
http://rhn.redhat.com/errata/RHSA-2016-2750.html
http://www.debian.org/security/2016/dsa-3602
Mailing List http://www.openwall.com/lists/oss-security/2016/05/05/21
http://www.securityfocus.com/bid/89844
Exploit https://bugs.php.net/bug.php?id=72094
https://git.php.net/?p=php-src.git%3Ba=commit%3Bh=082aecfc3a753ad03be82cf14f03ac...
Third Party Advisory https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c...
Third Party Advisory https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c...
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c...
https://security.gentoo.org/glsa/201611-22
Mailing List http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183736.html
http://lists.opensuse.org/opensuse-updates/2016-05/msg00086.html
Mailing List http://lists.opensuse.org/opensuse-updates/2016-06/msg00027.html
Patch http://php.net/ChangeLog-5.php
Patch http://php.net/ChangeLog-7.php
and 10 more references
63
/ 100
high-risk
Severity 32/34 · Critical
Exploitability 8/34 · Low
Exposure 23/34 · High