When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)
- CVSS 3.0 Base Score: 4.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-enchantUpgrade php-pecl-apcu-develUpgrade php-processUpgrade php-jsonUpgrade php-pecl-zipUpgrade php-mysqlndUpgrade php-xmlrpcUpgrade php-mbstringUpgrade libzip-toolsUpgrade php-embeddedUpgrade libzipUpgrade php-opcacheUpgrade php-dbaUpgrade php-gdUpgrade php-soapUpgrade php-gmpUpgrade php-pecl-rrdUpgrade php-recodeUpgrade php-pecl-xdebugUpgrade apcu-panelUpgrade php-snmpUpgrade php-dbgUpgrade php-bcmathUpgrade php-pecl-apcuUpgrade php-ldapUpgrade phpUpgrade php-cliUpgrade libzip-develUpgrade php-xmlUpgrade php-pdoUpgrade php-fpmUpgrade php-pgsqlUpgrade php-develUpgrade php-intlUpgrade php-pearUpgrade php-commonUpgrade php-odbc | May 4, 2022 | Aug 9, 2019 |
| Alpine Linux | — | Upgrade php7 | Oct 1, 2024 | Aug 9, 2019 |
| Amazon_linux | — | Upgrade php72Upgrade php73Upgrade php71 | Sep 19, 2019 | Aug 9, 2019 |
| Apple Osx Apachemodphp | — | Apply OS X security update 2019-001 MojaveApply OS X security update 2019-006 High SierraUpgrade macOS to the latest version | Oct 8, 2019 | Aug 9, 2019 |
| Centos_linux | — | Upgrade php-enchantUpgrade php-snmpUpgrade php-debuginfoUpgrade php-ldap-debuginfoUpgrade php-cliUpgrade php-dba-debuginfoUpgrade php-opcacheUpgrade php-embeddedUpgrade php-embedded-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade libzip-debuginfoUpgrade php-ldapUpgrade php-pgsqlUpgrade php-pecl-apcu-debugsourceUpgrade php-soapUpgrade php-fpm-debuginfoUpgrade php-dbgUpgrade php-json-debuginfoUpgrade php-mysqlndUpgrade php-mbstring-debuginfoUpgrade php-gd-debuginfoUpgrade php-debugsourceUpgrade php-processUpgrade php-gdUpgrade php-process-debuginfoUpgrade php-cli-debuginfoUpgrade php-recodeUpgrade php-soap-debuginfoUpgrade phpUpgrade php-intlUpgrade php-pdo-debuginfoUpgrade php-gmp-debuginfoUpgrade apcu-panelUpgrade libzip-debugsourceUpgrade php-pecl-zip-debuginfoUpgrade libzip-develUpgrade php-snmp-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-bcmath-debuginfoUpgrade php-dbaUpgrade libzip-toolsUpgrade php-pecl-rrdUpgrade php-odbcUpgrade php-xml-debuginfoUpgrade php-pearUpgrade php-xmlrpcUpgrade php-xmlrpc-debuginfoUpgrade php-pecl-zipUpgrade php-xmlUpgrade php-pecl-zip-debugsourceUpgrade php-develUpgrade php-bcmathUpgrade php-opcache-debuginfoUpgrade php-recode-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-enchant-debuginfoUpgrade php-pdoUpgrade php-intl-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-odbc-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-fpmUpgrade php-pecl-apcuUpgrade php-gmpUpgrade libzip-tools-debuginfoUpgrade php-mbstringUpgrade php-dbg-debuginfoUpgrade php-pecl-apcu-develUpgrade php-commonUpgrade php-jsonUpgrade php-pecl-xdebugUpgrade libzipUpgrade php-mysqlnd-debuginfoUpgrade php-common-debuginfo | Apr 29, 2020 | Aug 9, 2019 |
| Debian | — | Upgrade php7.3 | Aug 14, 2019 | Aug 9, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade php-recodeUpgrade php-xmlrpcUpgrade php-gdUpgrade php-pdoUpgrade php-processUpgrade php-xmlUpgrade php-cliUpgrade php-mysqlUpgrade phpUpgrade php-commonUpgrade php-soapUpgrade php-pgsqlUpgrade php-ldapUpgrade php-odbc | Dec 4, 2019 | Aug 9, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade php-processUpgrade php-xmlrpcUpgrade php-pdoUpgrade php-pgsqlUpgrade php-soapUpgrade php-commonUpgrade php-xmlUpgrade php-mysqlUpgrade php-ldapUpgrade phpUpgrade php-odbcUpgrade php-recodeUpgrade php-gdUpgrade php-cli | Sep 25, 2019 | Aug 9, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade php-recodeUpgrade php-xmlUpgrade phpUpgrade php-fpmUpgrade php-odbcUpgrade php-cliUpgrade php-ldapUpgrade php-commonUpgrade php-gdUpgrade php-processUpgrade php-xmlrpcUpgrade php-pdoUpgrade php-soap | Sep 30, 2019 | Aug 9, 2019 |
| Oracle Solaris | — | Upgrade web/php-73 to version 7.3.9-11.4.15.0.1.1.0 on Solaris 11.4Upgrade web/php-71 to version 7.1.32-11.4.15.0.1.1.0 on Solaris 11.4 | Nov 20, 2019 | Aug 9, 2019 |
| Oracle_linux | — | Upgrade php-intlUpgrade php-snmpUpgrade php-mbstringUpgrade php-recodeUpgrade php-cliUpgrade apcu-panelUpgrade php-opcacheUpgrade php-mysqlndUpgrade php-commonUpgrade libzip-develUpgrade php-processUpgrade php-dbaUpgrade php-xmlrpcUpgrade libzip-toolsUpgrade php-pecl-rrdUpgrade php-odbcUpgrade php-xmlUpgrade php-gdUpgrade php-pecl-xdebugUpgrade php-pecl-apcu-develUpgrade php-dbgUpgrade php-develUpgrade php-pgsqlUpgrade libzipUpgrade php-pdoUpgrade php-fpmUpgrade php-embeddedUpgrade php-pecl-zipUpgrade php-enchantUpgrade php-pecl-apcuUpgrade php-pearUpgrade php-soapUpgrade php-bcmathUpgrade phpUpgrade php-ldapUpgrade php-jsonUpgrade php-gmp | Sep 10, 2020 | Aug 9, 2019 |
| Php | — | Upgrade to PHP version 7.3.8Upgrade to PHP version 7.1.31Upgrade to PHP version 7.2.21 | Aug 27, 2019 | Aug 9, 2019 |
| Redhat_linux | — | No solution existsUpgrade php-commonUpgrade php-json-debuginfoUpgrade php-debuginfoUpgrade php-odbcUpgrade php-xml-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-soap-debuginfoUpgrade php-pgsqlUpgrade php-enchant-debuginfoUpgrade php-dba-debuginfoUpgrade libzip-toolsUpgrade php-pecl-xdebugUpgrade php-pecl-xdebug-debugsourceUpgrade php-process-debuginfoUpgrade php-common-debuginfoUpgrade php-intl-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-fpm-debuginfoUpgrade php-mbstringUpgrade php-opcache-debuginfoUpgrade php-pdo-debuginfoUpgrade libzip-debuginfoUpgrade php-xmlrpcUpgrade php-cli-debuginfoUpgrade php-odbc-debuginfoUpgrade php-snmp-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-dbgUpgrade php-ldap-debuginfoUpgrade php-pearUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-rrd-debuginfoUpgrade phpUpgrade php-debugsourceUpgrade php-pecl-apcu-debuginfoUpgrade php-opcacheUpgrade php-gdUpgrade php-pgsql-debuginfoUpgrade libzip-develUpgrade php-xmlUpgrade php-pecl-apcu-develUpgrade php-cliUpgrade php-embeddedUpgrade php-pecl-xdebug-debuginfoUpgrade php-pecl-rrdUpgrade php-xmlrpc-debuginfoUpgrade php-gmpUpgrade php-mysqlndUpgrade php-bcmathUpgrade apcu-panelUpgrade php-recodeUpgrade libzipUpgrade php-gd-debuginfoUpgrade php-enchantUpgrade libzip-tools-debuginfoUpgrade php-pdoUpgrade php-gmp-debuginfoUpgrade php-recode-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-pecl-apcuUpgrade php-soapUpgrade php-pecl-zipUpgrade php-develUpgrade php-dbaUpgrade php-processUpgrade php-intlUpgrade php-pecl-rrd-debugsourceUpgrade php-fpmUpgrade libzip-debugsourceUpgrade php-snmpUpgrade php-dbg-debuginfoUpgrade php-embedded-debuginfoUpgrade php-ldapUpgrade php-json | Apr 29, 2020 | Aug 9, 2019 |
| Rocky_linux | — | Upgrade php-soapUpgrade php-recode-debuginfoUpgrade php-cliUpgrade php-pecl-xdebug-debuginfoUpgrade php-bcmathUpgrade php-gdUpgrade libzip-debugsourceUpgrade php-pecl-apcuUpgrade php-bcmath-debuginfoUpgrade php-fpm-debuginfoUpgrade php-enchant-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-pecl-apcu-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-debugsourceUpgrade php-intlUpgrade php-pgsql-debuginfoUpgrade php-pecl-zipUpgrade php-gmp-debuginfoUpgrade php-gmpUpgrade php-mysqlndUpgrade libzipUpgrade php-ldapUpgrade php-xmlUpgrade php-pecl-zip-debuginfoUpgrade php-opcacheUpgrade php-jsonUpgrade php-embedded-debuginfoUpgrade php-recodeUpgrade php-dbaUpgrade php-enchantUpgrade php-embeddedUpgrade php-pdoUpgrade phpUpgrade php-process-debuginfoUpgrade libzip-develUpgrade php-gd-debuginfoUpgrade php-dbgUpgrade php-pecl-apcu-debugsourceUpgrade php-snmpUpgrade libzip-tools-debuginfoUpgrade php-odbcUpgrade php-processUpgrade libzip-toolsUpgrade php-ldap-debuginfoUpgrade libzip-debuginfoUpgrade php-fpmUpgrade php-snmp-debuginfoUpgrade php-dba-debuginfoUpgrade php-intl-debuginfoUpgrade php-odbc-debuginfoUpgrade php-cli-debuginfoUpgrade php-pecl-rrdUpgrade php-xmlrpcUpgrade php-pgsqlUpgrade php-opcache-debuginfoUpgrade php-develUpgrade php-commonUpgrade php-xml-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-mysqlnd-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-debuginfoUpgrade php-common-debuginfoUpgrade php-soap-debuginfoUpgrade php-pdo-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-pecl-apcu-develUpgrade php-pecl-xdebugUpgrade php-mbstringUpgrade php-pecl-rrd-debuginfoUpgrade php-json-debuginfoUpgrade php-dbg-debuginfo | Mar 12, 2024 | Aug 9, 2019 |
| Suse | — | Upgrade php53-pcntlUpgrade php72-ctypeUpgrade php72-pcntlUpgrade php72-jsonUpgrade php7-zlibUpgrade php53-xmlrpcUpgrade php53-tokenizerUpgrade php7-gettextUpgrade php5-wddxUpgrade php53-iconvUpgrade php7-sqliteUpgrade php72-snmpUpgrade php7-pear-archive_tarUpgrade php53-snmpUpgrade php7-develUpgrade php53-xmlreaderUpgrade php53Upgrade php7-mysqlUpgrade apache2-mod_php72Upgrade php7-soapUpgrade php53-opensslUpgrade php72-ftpUpgrade php5-curlUpgrade php5-ftpUpgrade php72-gmpUpgrade php53-wddxUpgrade php72-dbaUpgrade php7-readlineUpgrade php5-pgsqlUpgrade php53-gdUpgrade apache2-mod_php53Upgrade php5-dbaUpgrade php7-iconvUpgrade php72-gettextUpgrade php72-pspellUpgrade php53-intlUpgrade php72-enchantUpgrade php72-iconvUpgrade apache2-mod_php5Upgrade php53-bz2Upgrade php7-opcacheUpgrade php5-enchantUpgrade php7-shmopUpgrade php72-odbcUpgrade php72-gdUpgrade php53-fastcgiUpgrade php53-zlibUpgrade php53-xmlwriterUpgrade php53-ftpUpgrade php53-curlUpgrade php5-iconvUpgrade php5-domUpgrade php72-develUpgrade php72-calendarUpgrade php5-zlibUpgrade php53-gmpUpgrade php5-xmlwriterUpgrade php53-dbaUpgrade php7-posixUpgrade php7-pdoUpgrade php72-tidyUpgrade php7-zipUpgrade php7-socketsUpgrade php72-opcacheUpgrade php72-sysvsemUpgrade php53-pgsqlUpgrade php72-bcmathUpgrade php53-zipUpgrade php7-bcmathUpgrade php53-pearUpgrade php7-pspellUpgrade php5-tokenizerUpgrade php53-pspellUpgrade php72-xmlreaderUpgrade php5-odbcUpgrade php53-exifUpgrade php53-xslUpgrade php5-snmpUpgrade php53-gettextUpgrade php7-odbcUpgrade php5-mbstringUpgrade php5-opcacheUpgrade php72-exifUpgrade php7-ldapUpgrade php7-bz2Upgrade php72-xmlrpcUpgrade php5-ctypeUpgrade php7-sysvsemUpgrade php7-calendarUpgrade php7-pearUpgrade php72-pear-archive_tarUpgrade php5-exifUpgrade php53-domUpgrade php7-sysvmsgUpgrade php7-xmlreaderUpgrade php72-sqliteUpgrade php5-sysvmsgUpgrade php5-pharUpgrade php7-fileinfoUpgrade php72-fastcgiUpgrade php72-curlUpgrade php7-pcntlUpgrade php7-sodiumUpgrade php7-fastcgiUpgrade php5-mysqlUpgrade php5-imapUpgrade php72-mbstringUpgrade php72-zipUpgrade php5-calendarUpgrade php5-socketsUpgrade php5-zipUpgrade php5-fileinfoUpgrade php53-mysqlUpgrade php72-sysvshmUpgrade php72-bz2Upgrade php7-opensslUpgrade php5-gdUpgrade php7-fpmUpgrade php5-develUpgrade php7-pgsqlUpgrade php72-soapUpgrade php72-ldapUpgrade php53-pdoUpgrade php7-ctypeUpgrade php5-ldapUpgrade php53-soapUpgrade php5-bcmathUpgrade php5-pcntlUpgrade php5-sysvshmUpgrade php5-shmopUpgrade php7-sysvshmUpgrade php5-gettextUpgrade php72-xmlwriterUpgrade php72-socketsUpgrade php53-ctypeUpgrade php53-mbstringUpgrade php7-tidyUpgrade php53-jsonUpgrade php72-readlineUpgrade php5-pearUpgrade php7-xslUpgrade php53-mcryptUpgrade php7-pharUpgrade php7-domUpgrade php72-shmopUpgrade php5-sqliteUpgrade php72-pgsqlUpgrade php7-gdUpgrade php5-sysvsemUpgrade php5-fpmUpgrade php72-intlUpgrade php5-intlUpgrade php7-xmlwriterUpgrade php72-pdoUpgrade php72-domUpgrade php72-posixUpgrade php7-tokenizerUpgrade apache2-mod_php7Upgrade php7-dbaUpgrade php7-wddxUpgrade php5-gmpUpgrade php5-jsonUpgrade php53-sysvshmUpgrade php5-soapUpgrade php7-firebirdUpgrade php5-opensslUpgrade php53-sysvmsgUpgrade php53-bcmathUpgrade php72-wddxUpgrade php53-odbcUpgrade php5-mcryptUpgrade php7-exifUpgrade php7Upgrade php72-pearUpgrade php7-imapUpgrade php7-mbstringUpgrade php53-shmopUpgrade php5-xmlreaderUpgrade php7-intlUpgrade php72-pharUpgrade php7-jsonUpgrade php5-xslUpgrade php72-zlibUpgrade php5-suhosinUpgrade php5-fastcgiUpgrade php72-mysqlUpgrade php72-imapUpgrade php5-pspellUpgrade php7-gmpUpgrade php72-xslUpgrade php72-fpmUpgrade php7-embedUpgrade php53-suhosinUpgrade php5-xmlrpcUpgrade php7-enchantUpgrade php53-fileinfoUpgrade php7-mcryptUpgrade php53-sysvsemUpgrade php72-tokenizerUpgrade php53-ldapUpgrade php72Upgrade php5-bz2Upgrade php5Upgrade php7-snmpUpgrade php7-ftpUpgrade php5-pdoUpgrade php72-opensslUpgrade php72-sysvmsgUpgrade php72-fileinfoUpgrade php5-posixUpgrade php53-calendarUpgrade php7-curlUpgrade php7-xmlrpc | Aug 30, 2019 | Aug 9, 2019 |
| Ubuntu | — | Upgrade php7.0-xmlrpcUpgrade php7.2-xmlrpcUpgrade php7.0-cliUpgrade php5-cgi (Ubuntu Pro)Upgrade php7.0-fpmUpgrade php5-xmlrpc (Ubuntu Pro)Upgrade php5-fpm (Ubuntu Pro)Upgrade php7.2-fpmUpgrade libapache2-mod-php5Upgrade libapache2-mod-php7.0Upgrade libapache2-mod-php7.2Upgrade php5-xmlrpcUpgrade php7.0-cgiUpgrade php7.2-cgiUpgrade php7.2-cliUpgrade libapache2-mod-php5 (Ubuntu Pro)Upgrade php5-cli (Ubuntu Pro)Upgrade php5-cliUpgrade php5-cgiUpgrade php5-fpm | Aug 14, 2019 | Aug 9, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub