Heap over-read in PHP EXIF extension
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.8epss 4.4%
probabilidade de exploração
4.4%top 10% das CVEs
exploração observada
nãonenhuma fonte reporta
When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_iif_add_value function. This may lead to information disclosure or crash.
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Produtos afetados
PHP Group · PHPReferências
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00010.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-06/msg00012.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.htmlhttps://access.redhat.com/errata/RHSA-2019:2519https://access.redhat.com/errata/RHSA-2019:3299https://bugs.php.net/bug.php?id=77831https://lists.debian.org/debian-lts-announce/2019/05/msg00035.htmlhttps://seclists.org/bugtraq/2019/Sep/38https://security.netapp.com/advisory/ntap-20190502-0001/https://support.f5.com/csp/article/K44590877https://usn.ubuntu.com/3953-1/