When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)
- CVSS 3.0 Base Score: 4.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-gdUpgrade php-fpmUpgrade php-pgsqlUpgrade php-ldapUpgrade libzipUpgrade php-develUpgrade php-pdoUpgrade php-xmlrpcUpgrade php-processUpgrade php-pecl-rrdUpgrade php-bcmathUpgrade php-jsonUpgrade php-embeddedUpgrade php-pecl-apcu-develUpgrade php-dbaUpgrade php-soapUpgrade php-pecl-zipUpgrade php-enchantUpgrade php-gmpUpgrade apcu-panelUpgrade php-pecl-apcuUpgrade php-mbstringUpgrade php-recodeUpgrade php-pecl-xdebugUpgrade php-odbcUpgrade php-cliUpgrade php-intlUpgrade libzip-toolsUpgrade phpUpgrade libzip-develUpgrade php-snmpUpgrade php-pearUpgrade php-commonUpgrade php-mysqlndUpgrade php-opcacheUpgrade php-xmlUpgrade php-dbg | May 4, 2022 | Aug 9, 2019 |
| Alpine Linux | — | Upgrade php7 | Oct 1, 2024 | Aug 9, 2019 |
| Amazon_linux | — | Upgrade php72Upgrade php71Upgrade php73 | Sep 19, 2019 | Aug 9, 2019 |
| Apple Osx Apachemodphp | — | Upgrade macOS to the latest version | Oct 8, 2019 | Oct 7, 2019 |
| Centos_linux | — | Upgrade php-bcmathUpgrade php-pdoUpgrade php-mbstringUpgrade php-develUpgrade libzip-tools-debuginfoUpgrade php-jsonUpgrade php-pecl-apcu-develUpgrade php-odbc-debuginfoUpgrade php-pgsqlUpgrade php-embeddedUpgrade php-pecl-zipUpgrade php-pecl-apcu-debuginfoUpgrade php-pdo-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-fpmUpgrade libzip-debuginfoUpgrade php-dbaUpgrade php-xml-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-cli-debuginfoUpgrade php-pearUpgrade php-gd-debuginfoUpgrade php-pecl-apcuUpgrade php-dba-debuginfoUpgrade php-odbcUpgrade php-dbgUpgrade php-pecl-xdebug-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-gdUpgrade php-xmlrpc-debuginfoUpgrade php-pecl-xdebugUpgrade php-ldapUpgrade libzipUpgrade php-debugsourceUpgrade php-mysqlnd-debuginfoUpgrade php-dbg-debuginfoUpgrade php-enchant-debuginfoUpgrade libzip-debugsourceUpgrade php-xmlrpcUpgrade php-gmpUpgrade php-json-debuginfoUpgrade php-enchantUpgrade php-soapUpgrade php-pecl-rrdUpgrade php-snmp-debuginfoUpgrade php-recodeUpgrade php-debuginfoUpgrade php-xmlUpgrade php-process-debuginfoUpgrade php-mbstring-debuginfoUpgrade phpUpgrade php-pgsql-debuginfoUpgrade php-ldap-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-mysqlndUpgrade php-commonUpgrade libzip-develUpgrade php-bcmath-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-recode-debuginfoUpgrade php-processUpgrade php-gmp-debuginfoUpgrade php-opcacheUpgrade libzip-toolsUpgrade php-pecl-rrd-debugsourceUpgrade apcu-panelUpgrade php-snmpUpgrade php-intlUpgrade php-common-debuginfoUpgrade php-embedded-debuginfoUpgrade php-intl-debuginfoUpgrade php-cliUpgrade php-opcache-debuginfoUpgrade php-fpm-debuginfoUpgrade php-soap-debuginfo | Apr 29, 2020 | Aug 9, 2019 |
| Debian | — | Upgrade php7.3 | Aug 14, 2019 | Aug 9, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade php-pdoUpgrade php-processUpgrade php-ldapUpgrade php-pgsqlUpgrade php-soapUpgrade php-gdUpgrade php-odbcUpgrade php-recodeUpgrade php-cliUpgrade php-xmlrpcUpgrade php-commonUpgrade php-xmlUpgrade phpUpgrade php-mysql | Dec 4, 2019 | Aug 9, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade php-xmlUpgrade php-pdoUpgrade php-xmlrpcUpgrade php-gdUpgrade php-cliUpgrade php-mysqlUpgrade php-recodeUpgrade php-processUpgrade php-ldapUpgrade php-soapUpgrade php-pgsqlUpgrade php-odbcUpgrade phpUpgrade php-common | Sep 25, 2019 | Aug 9, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade php-odbcUpgrade php-commonUpgrade php-xmlrpcUpgrade php-processUpgrade php-xmlUpgrade php-cliUpgrade php-gdUpgrade php-soapUpgrade php-ldapUpgrade php-fpmUpgrade php-pdoUpgrade php-recodeUpgrade php | Sep 30, 2019 | Aug 9, 2019 |
| Oracle Solaris | — | Upgrade web/php-73 to version 7.3.9-11.4.15.0.1.1.0 on Solaris 11.4Upgrade web/php-71 to version 7.1.32-11.4.15.0.1.1.0 on Solaris 11.4 | Nov 20, 2019 | Aug 9, 2019 |
| Oracle_linux | — | Upgrade php-pecl-apcu-develUpgrade php-xmlrpcUpgrade php-dbaUpgrade php-pearUpgrade php-processUpgrade php-pecl-rrdUpgrade php-soapUpgrade php-commonUpgrade php-gmpUpgrade php-odbcUpgrade php-mbstringUpgrade php-develUpgrade php-pecl-zipUpgrade php-jsonUpgrade php-pecl-xdebugUpgrade php-pgsqlUpgrade php-fpmUpgrade php-pdoUpgrade libzip-toolsUpgrade php-opcacheUpgrade php-snmpUpgrade libzipUpgrade php-dbgUpgrade apcu-panelUpgrade php-recodeUpgrade php-bcmathUpgrade phpUpgrade php-ldapUpgrade php-embeddedUpgrade libzip-develUpgrade php-intlUpgrade php-enchantUpgrade php-mysqlndUpgrade php-gdUpgrade php-xmlUpgrade php-pecl-apcuUpgrade php-cli | Sep 10, 2020 | Aug 9, 2019 |
| Php | — | Upgrade to PHP version 7.2.21Upgrade to PHP version 7.3.8Upgrade to PHP version 7.1.31 | Aug 27, 2019 | Aug 9, 2019 |
| Redhat_linux | — | Upgrade php-dbgUpgrade apcu-panelUpgrade libzip-tools-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-odbcUpgrade php-xmlUpgrade php-pecl-zip-debugsourceUpgrade php-recodeUpgrade php-enchantUpgrade php-pdoUpgrade php-pecl-rrd-debugsourceUpgrade php-pgsql-debuginfoUpgrade php-intlUpgrade php-pecl-zipUpgrade phpUpgrade php-fpm-debuginfoUpgrade php-json-debuginfoUpgrade php-embeddedUpgrade php-pecl-apcu-develUpgrade php-gd-debuginfoUpgrade libzip-debuginfoUpgrade php-develUpgrade php-mysqlndUpgrade libzipUpgrade php-pecl-zip-debuginfoUpgrade php-common-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-jsonUpgrade php-mbstring-debuginfoUpgrade php-pecl-apcuUpgrade php-ldapUpgrade php-soapNo solution existsUpgrade php-pecl-xdebug-debugsourceUpgrade php-opcacheUpgrade php-gmpUpgrade php-fpmUpgrade php-recode-debuginfoUpgrade php-pgsqlUpgrade php-gmp-debuginfoUpgrade php-embedded-debuginfoUpgrade php-enchant-debuginfoUpgrade php-debugsourceUpgrade php-bcmathUpgrade php-xmlrpc-debuginfoUpgrade php-gdUpgrade php-processUpgrade php-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade libzip-toolsUpgrade php-pearUpgrade php-cliUpgrade php-mbstringUpgrade php-soap-debuginfoUpgrade php-odbc-debuginfoUpgrade php-snmpUpgrade libzip-debugsourceUpgrade php-xmlrpcUpgrade php-xml-debuginfoUpgrade php-pdo-debuginfoUpgrade php-dbg-debuginfoUpgrade php-opcache-debuginfoUpgrade php-snmp-debuginfoUpgrade libzip-develUpgrade php-dba-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-commonUpgrade php-dbaUpgrade php-intl-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-ldap-debuginfoUpgrade php-process-debuginfoUpgrade php-pecl-xdebugUpgrade php-cli-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-pecl-rrd | Apr 29, 2020 | Aug 9, 2019 |
| Rocky_linux | — | Upgrade php-recode-debuginfoUpgrade libzip-develUpgrade php-ldap-debuginfoUpgrade php-xmlUpgrade php-common-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-xml-debuginfoUpgrade php-cliUpgrade php-pecl-rrd-debuginfoUpgrade php-commonUpgrade php-processUpgrade libzip-debuginfoUpgrade php-process-debuginfoUpgrade php-pgsqlUpgrade php-odbcUpgrade php-snmp-debuginfoUpgrade php-dba-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-pecl-rrdUpgrade libzip-toolsUpgrade php-dbg-debuginfoUpgrade php-intl-debuginfoUpgrade php-debuginfoUpgrade php-opcache-debuginfoUpgrade php-mbstringUpgrade php-snmpUpgrade php-json-debuginfoUpgrade php-xmlrpcUpgrade php-mbstring-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-pgsql-debuginfoUpgrade php-soap-debuginfoUpgrade php-opcacheUpgrade php-soapUpgrade php-pecl-rrd-debugsourceUpgrade php-enchant-debuginfoUpgrade php-enchantUpgrade php-pecl-xdebug-debuginfoUpgrade php-pecl-xdebugUpgrade php-dbaUpgrade php-recodeUpgrade php-mysqlndUpgrade php-pecl-apcu-develUpgrade php-develUpgrade php-odbc-debuginfoUpgrade php-ldapUpgrade php-fpm-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade phpUpgrade php-embeddedUpgrade libzip-tools-debuginfoUpgrade php-gmpUpgrade php-debugsourceUpgrade php-jsonUpgrade php-pdo-debuginfoUpgrade php-pecl-zipUpgrade php-pecl-apcuUpgrade php-gd-debuginfoUpgrade php-fpmUpgrade php-pecl-apcu-debuginfoUpgrade libzip-debugsourceUpgrade php-xmlrpc-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-zip-debuginfoUpgrade php-bcmathUpgrade php-pdoUpgrade php-intlUpgrade libzipUpgrade php-gmp-debuginfoUpgrade php-embedded-debuginfoUpgrade php-dbgUpgrade php-cli-debuginfoUpgrade php-gd | Mar 12, 2024 | Aug 9, 2019 |
| Suse | — | Upgrade php72-odbcUpgrade php7-shmopUpgrade php72-tidyUpgrade php7-enchantUpgrade php5-enchantUpgrade php53-odbcUpgrade php53-bz2Upgrade php72-posixUpgrade php53-pgsqlUpgrade php53-domUpgrade php72-enchantUpgrade php72-pspellUpgrade php72-fastcgiUpgrade php7-firebirdUpgrade php53-opensslUpgrade php7-sodiumUpgrade php7-intlUpgrade php5-dbaUpgrade apache2-mod_php5Upgrade php53-exifUpgrade php5-zipUpgrade php7-socketsUpgrade php7-pdoUpgrade php7-ftpUpgrade php5-mcryptUpgrade php72-fileinfoUpgrade php53-fastcgiUpgrade php72-bcmathUpgrade php7-curlUpgrade php5-wddxUpgrade php7-wddxUpgrade php5-mbstringUpgrade php5-ftpUpgrade php7-iconvUpgrade php5-xmlwriterUpgrade php53-xmlrpcUpgrade php5-posixUpgrade php7-pearUpgrade php7-tokenizerUpgrade php72-imapUpgrade php7-pspellUpgrade php53-curlUpgrade php53-gettextUpgrade php53-gmpUpgrade php72-calendarUpgrade php5-opcacheUpgrade php72-ctypeUpgrade php5-mysqlUpgrade php53-mbstringUpgrade php72-sysvsemUpgrade php53-wddxUpgrade php7-gmpUpgrade php5-pcntlUpgrade php53-zipUpgrade php7-tidyUpgrade php72-zlibUpgrade php53-iconvUpgrade php53-dbaUpgrade php5-gettextUpgrade php53-mysqlUpgrade php53-xmlreaderUpgrade php5-xmlreaderUpgrade php7-sqliteUpgrade php72Upgrade php7-xmlwriterUpgrade php53-intlUpgrade php5-gmpUpgrade php53-tokenizerUpgrade php72-snmpUpgrade php7-posixUpgrade php72-ldapUpgrade php5-develUpgrade php72-socketsUpgrade php7Upgrade php72-opcacheUpgrade php7-soapUpgrade php53-ftpUpgrade php7-sysvsemUpgrade php5-pgsqlUpgrade php5-zlibUpgrade php72-shmopUpgrade php7-xmlreaderUpgrade php72-readlineUpgrade php72-develUpgrade php53-ldapUpgrade php7-pgsqlUpgrade php53-pearUpgrade php72-soapUpgrade php53-bcmathUpgrade php7-domUpgrade php7-opcacheUpgrade php7-mysqlUpgrade php72-xmlrpcUpgrade php7-odbcUpgrade php53-pspellUpgrade php5-tokenizerUpgrade php7-zipUpgrade php5-calendarUpgrade php72-sysvmsgUpgrade php7-snmpUpgrade php53-suhosinUpgrade php72-xmlreaderUpgrade php7-gettextUpgrade php7-opensslUpgrade php53-sysvmsgUpgrade php53-shmopUpgrade php72-pcntlUpgrade php5-sysvmsgUpgrade php53-jsonUpgrade php53-pdoUpgrade php7-pcntlUpgrade php53Upgrade php5-shmopUpgrade php5-fastcgiUpgrade php7-ctypeUpgrade php5-jsonUpgrade php5Upgrade php53-sysvshmUpgrade php5-fpmUpgrade php53-xmlwriterUpgrade php72-jsonUpgrade php53-calendarUpgrade php5-sqliteUpgrade php5-suhosinUpgrade php7-fpmUpgrade php53-snmpUpgrade php7-embedUpgrade php5-snmpUpgrade php7-jsonUpgrade php5-fileinfoUpgrade php7-exifUpgrade php72-gmpUpgrade php72-xmlwriterUpgrade php5-soapUpgrade php53-soapUpgrade php72-pearUpgrade php53-ctypeUpgrade php5-sysvshmUpgrade php5-imapUpgrade php72-mysqlUpgrade php5-pspellUpgrade php7-fileinfoUpgrade php53-mcryptUpgrade php53-sysvsemUpgrade php72-gettextUpgrade php7-gdUpgrade php5-sysvsemUpgrade php72-pdoUpgrade php5-xslUpgrade php7-xmlrpcUpgrade php72-xslUpgrade php72-sqliteUpgrade php72-opensslUpgrade php5-opensslUpgrade php5-ldapUpgrade php5-bz2Upgrade php7-imapUpgrade php7-mcryptUpgrade php53-xslUpgrade php5-curlUpgrade php5-gdUpgrade php5-iconvUpgrade php7-pear-archive_tarUpgrade php72-exifUpgrade php72-iconvUpgrade php72-pear-archive_tarUpgrade php7-sysvshmUpgrade apache2-mod_php7Upgrade php7-bz2Upgrade php7-dbaUpgrade php7-readlineUpgrade php72-pgsqlUpgrade php5-bcmathUpgrade php53-pcntlUpgrade php7-sysvmsgUpgrade apache2-mod_php72Upgrade php5-exifUpgrade php72-bz2Upgrade php7-develUpgrade php5-intlUpgrade php7-xslUpgrade php5-ctypeUpgrade apache2-mod_php53Upgrade php72-sysvshmUpgrade php72-curlUpgrade php72-ftpUpgrade php5-odbcUpgrade php5-pharUpgrade php7-calendarUpgrade php5-domUpgrade php7-fastcgiUpgrade php72-zipUpgrade php53-fileinfoUpgrade php7-mbstringUpgrade php5-socketsUpgrade php72-intlUpgrade php53-zlibUpgrade php72-dbaUpgrade php5-pdoUpgrade php72-domUpgrade php72-tokenizerUpgrade php53-gdUpgrade php72-wddxUpgrade php72-mbstringUpgrade php7-zlibUpgrade php5-pearUpgrade php7-pharUpgrade php7-bcmathUpgrade php72-pharUpgrade php5-xmlrpcUpgrade php7-ldapUpgrade php72-fpmUpgrade php72-gd | Aug 29, 2019 | Aug 9, 2019 |
| Ubuntu | — | Upgrade php5-fpm (Ubuntu Pro)Upgrade php7.0-cliUpgrade php5-xmlrpcUpgrade php7.0-xmlrpcUpgrade php7.2-cgiUpgrade php7.2-cliUpgrade php5-cgi (Ubuntu Pro)Upgrade php7.2-fpmUpgrade php7.2-xmlrpcUpgrade libapache2-mod-php7.0Upgrade libapache2-mod-php5 (Ubuntu Pro)Upgrade php7.0-fpmUpgrade libapache2-mod-php7.2Upgrade libapache2-mod-php5Upgrade php7.0-cgiUpgrade php5-cgiUpgrade php5-cliUpgrade php5-fpmUpgrade php5-cli (Ubuntu Pro)Upgrade php5-xmlrpc (Ubuntu Pro) | Aug 14, 2019 | Aug 9, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub