When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
- CVSS 3.0 Base Score: 4.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libzip-develUpgrade php-mysqlndUpgrade php-pgsqlUpgrade php-xmlrpcUpgrade libzip-toolsUpgrade php-processUpgrade php-dbaUpgrade php-xmlUpgrade php-cliUpgrade php-commonUpgrade php-snmpUpgrade php-odbcUpgrade php-mbstringUpgrade php-recodeUpgrade php-pdoUpgrade phpUpgrade php-pecl-zipUpgrade php-develUpgrade php-ldapUpgrade php-dbgUpgrade php-pearUpgrade libzipUpgrade php-gmpUpgrade php-pecl-apcuUpgrade php-jsonUpgrade php-gdUpgrade apcu-panelUpgrade php-bcmathUpgrade php-intlUpgrade php-enchantUpgrade php-embeddedUpgrade php-fpmUpgrade php-pecl-apcu-develUpgrade php-soapUpgrade php-opcache | May 4, 2022 | Apr 18, 2019 |
| Alpine Linux | — | Upgrade php7 | Oct 1, 2024 | Apr 18, 2019 |
| Amazon_linux | — | Upgrade php72Upgrade php73Upgrade php71 | Jun 14, 2019 | Apr 18, 2019 |
| Centos_linux | — | Upgrade php-dbgUpgrade php-mysqlnd-debuginfoUpgrade php-pecl-apcuUpgrade php-develUpgrade php-pecl-zip-debuginfoUpgrade libzip-debuginfoUpgrade php-odbc-debuginfoUpgrade php-enchant-debuginfoUpgrade php-pgsqlUpgrade php-snmpUpgrade php-common-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-xml-debuginfoUpgrade php-xmlUpgrade php-gmp-debuginfoUpgrade php-json-debuginfoUpgrade php-pdo-debuginfoUpgrade php-dba-debuginfoUpgrade apcu-panelUpgrade php-odbcUpgrade php-ldapUpgrade libzip-develUpgrade php-pgsql-debuginfoUpgrade php-pdoUpgrade php-pecl-apcu-debugsourceUpgrade php-bcmathUpgrade php-intlUpgrade phpUpgrade php-fpmUpgrade php-commonUpgrade php-fpm-debuginfoUpgrade php-opcacheUpgrade php-recode-debuginfoUpgrade php-pecl-zipUpgrade php-opcache-debuginfoUpgrade libzipUpgrade php-cli-debuginfoUpgrade php-debuginfoUpgrade php-mysqlndUpgrade php-snmp-debuginfoUpgrade php-gmpUpgrade libzip-debugsourceUpgrade php-soap-debuginfoUpgrade php-dbg-debuginfoUpgrade php-gdUpgrade php-dbaUpgrade php-pearUpgrade php-debugsourceUpgrade php-process-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-soapUpgrade php-embedded-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-recodeUpgrade libzip-toolsUpgrade php-bcmath-debuginfoUpgrade php-pecl-apcu-develUpgrade php-mbstringUpgrade php-jsonUpgrade php-gd-debuginfoUpgrade php-ldap-debuginfoUpgrade php-cliUpgrade libzip-tools-debuginfoUpgrade php-processUpgrade php-intl-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-enchantUpgrade php-embeddedUpgrade php-xmlrpc | Apr 29, 2020 | Apr 18, 2019 |
| Debian | — | Upgrade php7.3 | May 27, 2019 | Apr 18, 2019 |
| Freebsd | — | Upgrade php72-exifUpgrade php71-exifUpgrade php73-exif | May 11, 2019 | May 11, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade php-xmlUpgrade php-ldapUpgrade phpUpgrade php-cliUpgrade php-recodeUpgrade php-odbcUpgrade php-gdUpgrade php-xmlrpcUpgrade php-processUpgrade php-mysqlUpgrade php-commonUpgrade php-pdoUpgrade php-pgsqlUpgrade php-soap | Jul 23, 2019 | Apr 18, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade php-gdUpgrade php-pdoUpgrade php-cliUpgrade php-ldapUpgrade phpUpgrade php-odbcUpgrade php-recodeUpgrade php-pgsqlUpgrade php-soapUpgrade php-processUpgrade php-commonUpgrade php-xmlrpcUpgrade php-xmlUpgrade php-mysql | Sep 25, 2019 | Apr 18, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade php-xmlrpcUpgrade php-mysqlUpgrade php-xmlUpgrade php-odbcUpgrade php-commonUpgrade php-recodeUpgrade php-cliUpgrade php-processUpgrade php-gdUpgrade php-pgsqlUpgrade php-pdoUpgrade phpUpgrade php-ldapUpgrade php-soap | Jul 2, 2019 | Apr 18, 2019 |
| Oracle Solaris | — | Upgrade web/php-73 to version 7.3.9-11.4.15.0.1.1.0 on Solaris 11.4Upgrade web/php-71 to version 7.1.32-11.4.15.0.1.1.0 on Solaris 11.4 | Nov 20, 2019 | Apr 18, 2019 |
| Oracle_linux | — | Upgrade php-recodeUpgrade php-cliUpgrade php-xmlUpgrade php-commonUpgrade libzip-develUpgrade php-xmlrpcUpgrade php-mysqlndUpgrade apcu-panelUpgrade php-opcacheUpgrade php-snmpUpgrade php-odbcUpgrade php-mbstringUpgrade php-dbaUpgrade php-processUpgrade php-intlUpgrade libzip-toolsUpgrade php-pdoUpgrade php-pecl-apcu-develUpgrade php-jsonUpgrade php-fpmUpgrade php-pgsqlUpgrade php-pecl-zipUpgrade php-pecl-apcuUpgrade php-soapUpgrade php-gmpUpgrade php-pearUpgrade php-bcmathUpgrade php-dbgUpgrade php-enchantUpgrade php-develUpgrade libzipUpgrade phpUpgrade php-gdUpgrade php-embeddedUpgrade php-ldap | Jul 22, 2024 | Mar 16, 2019 |
| Php | — | Upgrade to PHP version 7.2.17Upgrade to PHP version 7.3.4Upgrade to PHP version 7.1.28 | Apr 23, 2019 | Apr 18, 2019 |
| Redhat_linux | — | Upgrade apcu-panelUpgrade php-ldap-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-soapUpgrade php-pgsql-debuginfoUpgrade php-gdUpgrade php-mysqlnd-debuginfoUpgrade php-snmp-debuginfoUpgrade php-intlUpgrade php-mbstringUpgrade php-dbaUpgrade php-intl-debuginfoUpgrade php-dbg-debuginfoUpgrade libzip-toolsUpgrade libzip-tools-debuginfoUpgrade php-process-debuginfoUpgrade php-opcache-debuginfoUpgrade libzip-develUpgrade php-xmlrpcUpgrade php-pdo-debuginfoUpgrade php-pecl-apcu-develUpgrade libzip-debugsourceUpgrade php-mysqlndUpgrade php-pecl-apcu-debuginfoUpgrade php-fpm-debuginfoUpgrade php-pgsqlUpgrade php-debuginfoUpgrade php-processUpgrade php-opcacheUpgrade php-soap-debuginfoUpgrade php-cli-debuginfoUpgrade php-enchantUpgrade php-pearUpgrade php-debugsourceUpgrade php-pecl-zip-debugsourceUpgrade php-common-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-gmpUpgrade php-odbcUpgrade php-xmlUpgrade php-dbgUpgrade php-commonUpgrade phpUpgrade php-fpmUpgrade php-embedded-debuginfoUpgrade php-recodeUpgrade php-mbstring-debuginfoUpgrade php-jsonUpgrade php-gd-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-dba-debuginfoUpgrade php-recode-debuginfoUpgrade libzipUpgrade php-embeddedUpgrade php-enchant-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-cliUpgrade php-pecl-apcuUpgrade php-json-debuginfoUpgrade php-develUpgrade php-gmp-debuginfoUpgrade php-pdoUpgrade php-pecl-zipNo solution existsUpgrade php-bcmathUpgrade php-odbc-debuginfoUpgrade php-ldapUpgrade libzip-debuginfoUpgrade php-xml-debuginfoUpgrade php-snmp | Apr 29, 2020 | Apr 18, 2019 |
| Rocky_linux | — | Upgrade php-ldap-debuginfoUpgrade libzip-toolsUpgrade php-enchant-debuginfoUpgrade php-intlUpgrade php-embedded-debuginfoUpgrade php-snmpUpgrade libzip-develUpgrade php-recodeUpgrade php-soap-debuginfoUpgrade php-common-debuginfoUpgrade phpUpgrade php-xmlUpgrade php-opcache-debuginfoUpgrade php-xmlrpcUpgrade php-debuginfoUpgrade php-recode-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-debugsourceUpgrade php-pecl-apcuUpgrade php-mysqlndUpgrade php-opcacheUpgrade php-pecl-apcu-debuginfoUpgrade php-ldapUpgrade php-pgsql-debuginfoUpgrade php-embeddedUpgrade php-cliUpgrade php-gmp-debuginfoUpgrade php-dbg-debuginfoUpgrade php-fpmUpgrade php-odbc-debuginfoUpgrade php-fpm-debuginfoUpgrade php-gdUpgrade php-develUpgrade php-bcmathUpgrade php-snmp-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-odbcUpgrade php-jsonUpgrade php-intl-debuginfoUpgrade php-cli-debuginfoUpgrade php-dba-debuginfoUpgrade php-gmpUpgrade php-gd-debuginfoUpgrade libzip-debuginfoUpgrade php-pgsqlUpgrade php-pecl-zip-debuginfoUpgrade php-mbstringUpgrade php-process-debuginfoUpgrade php-pdoUpgrade php-pdo-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-json-debuginfoUpgrade libzip-tools-debuginfoUpgrade libzip-debugsourceUpgrade php-processUpgrade php-pecl-apcu-debugsourceUpgrade libzipUpgrade php-enchantUpgrade php-soapUpgrade php-xml-debuginfoUpgrade php-dbaUpgrade php-commonUpgrade php-mbstring-debuginfoUpgrade php-dbgUpgrade php-pecl-zipUpgrade php-pecl-apcu-devel | Mar 12, 2024 | Apr 18, 2019 |
| Suse | — | Upgrade php5-enchantUpgrade php5-pearUpgrade php7-curlUpgrade php72-pearUpgrade php72-imapUpgrade php5-ctypeUpgrade php5-fileinfoUpgrade php7-testresultsUpgrade php7-pearUpgrade php5-pspellUpgrade php5-curlUpgrade php72-xslUpgrade php5-posixUpgrade php5-pgsqlUpgrade php72-gmpUpgrade php5-sysvmsgUpgrade php72-jsonUpgrade php7-xmlwriterUpgrade php72-tokenizerUpgrade php5-sysvshmUpgrade php7-mysqlUpgrade php5-fpmUpgrade php5-sqliteUpgrade apache2-mod_php72Upgrade php5-zlibUpgrade php5-ldapUpgrade php72-intlUpgrade php72-ldapUpgrade php72-bz2Upgrade php72-develUpgrade php72-socketsUpgrade php7-enchantUpgrade php72-gdUpgrade php7-zlibUpgrade php72-fastcgiUpgrade php72-iconvUpgrade php72-pharUpgrade php5-tokenizerUpgrade php7-intlUpgrade php7-zipUpgrade php7-develUpgrade php7-sysvshmUpgrade php5-develUpgrade php7-pspellUpgrade php7-bcmathUpgrade php7-mcryptUpgrade php7-shmopUpgrade php72-soapUpgrade php7-ctypeUpgrade php72-calendarUpgrade php5-gdUpgrade php72-enchantUpgrade php7-fileinfoUpgrade php72-domUpgrade php5-domUpgrade php5-socketsUpgrade php7-pcntlUpgrade php5-iconvUpgrade php5-suhosinUpgrade php72-odbcUpgrade php7-pharUpgrade php72-pspellUpgrade php7-tokenizerUpgrade php5-odbcUpgrade php72-zipUpgrade php72-pear-archive_tarUpgrade php5-dbaUpgrade php72-opensslUpgrade php72-pdoUpgrade php72-wddxUpgrade php72-dbaUpgrade php5-intlUpgrade php7-calendarUpgrade php7-wddxUpgrade php72-pcntlUpgrade php7-opensslUpgrade php7-sysvsemUpgrade php7-odbcUpgrade php7-snmpUpgrade php5-pcntlUpgrade php7-fastcgiUpgrade php72-sysvmsgUpgrade php7-iconvUpgrade php5-exifUpgrade php72-exifUpgrade php5-shmopUpgrade php7-posixUpgrade php5-fastcgiUpgrade php7-pgsqlUpgrade php72-posixUpgrade php7-xmlrpcUpgrade php72-bcmathUpgrade php72-zlibUpgrade apache2-mod_php5Upgrade php5-snmpUpgrade php72-pgsqlUpgrade php5-bcmathUpgrade php7-socketsUpgrade php5-pdoUpgrade php7-bz2Upgrade php72-ctypeUpgrade apache2-mod_php7Upgrade php5-opcacheUpgrade php72-curlUpgrade php72-tidyUpgrade php5-mysqlUpgrade php72-sysvsemUpgrade php5-soapUpgrade php72-gettextUpgrade php5-mcryptUpgrade php7-opcacheUpgrade php7-gmpUpgrade php72-ftpUpgrade php7-xmlreaderUpgrade php7-xslUpgrade php7-ftpUpgrade php72-fileinfoUpgrade php72-readlineUpgrade php5-xslUpgrade php5-xmlwriterUpgrade php7-sqliteUpgrade php5-xmlrpcUpgrade php72-xmlwriterUpgrade php7-gdUpgrade php5-calendarUpgrade php72-mysqlUpgrade php5-gmpUpgrade php5-jsonUpgrade php5Upgrade php72-mbstringUpgrade php7-tidyUpgrade php7-firebirdUpgrade php72-shmopUpgrade php7-dbaUpgrade php5-wddxUpgrade php72-opcacheUpgrade php7-soapUpgrade php72-fpmUpgrade php5-imapUpgrade php7-pear-archive_tarUpgrade php7-sodiumUpgrade php7-domUpgrade php5-opensslUpgrade php7-imapUpgrade php72-xmlrpcUpgrade php7-sysvmsgUpgrade php7-jsonUpgrade php7Upgrade php5-xmlreaderUpgrade php7-exifUpgrade php72-xmlreaderUpgrade php72Upgrade php5-ftpUpgrade php5-zipUpgrade php72-sysvshmUpgrade php7-pdoUpgrade php5-sysvsemUpgrade php5-gettextUpgrade php7-ldapUpgrade php5-pharUpgrade php7-fpmUpgrade php7-gettextUpgrade php5-mbstringUpgrade php7-mbstringUpgrade php72-snmpUpgrade php7-readlineUpgrade php7-embedUpgrade php72-sqliteUpgrade php5-bz2 | May 24, 2019 | Apr 18, 2019 |
| Ubuntu | — | Upgrade php5-cliUpgrade php5-fpm (Ubuntu Pro)Upgrade php7.2-fpmUpgrade php7.0-cliUpgrade libapache2-mod-php7.2Upgrade php7.0-cgiUpgrade php7.0-fpmUpgrade libapache2-mod-php5Upgrade php5-cgi (Ubuntu Pro)Upgrade php7.2-cgiUpgrade php5-cli (Ubuntu Pro)Upgrade libapache2-mod-php7.0Upgrade php5-fpmUpgrade libapache2-mod-php5 (Ubuntu Pro)Upgrade php5-cgiUpgrade php7.2-cli | May 1, 2019 | Apr 18, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub