CVE-2016-4543

Loading...

General

Score:7.5/10.0
Severity:High
Category:Buffer Error

Impact Metrics

Confidentiality:Partial
Integrity:Partial
Availability:Partial

Exploitability Metrics

Access Vector:Network
Access Complexity:Low
Authentication:None

Relative vulnerabilities

CVE-2004-1019, CVE-2006-7243, CVE-2013-7456, CVE-2014-0207, CVE-2014-3478, CVE-2014-3479, CVE-2014-3480, CVE-2014-3487, CVE-2014-3515, CVE-2014-3597, CVE-2014-3668, CVE-2014-3669, CVE-2014-3670, CVE-2014-4049, CVE-2014-4670, CVE-2014-4698, CVE-2014-4721, CVE-2014-5459, CVE-2014-8142, CVE-2014-9652, CVE-2014-9705, CVE-2014-9709, CVE-2014-9767, CVE-2015-0231, CVE-2015-0232, CVE-2015-0273, CVE-2015-1352, CVE-2015-2301, CVE-2015-2305, CVE-2015-2783, CVE-2015-2787, CVE-2015-3152, CVE-2015-3329, CVE-2015-3411, CVE-2015-3412, CVE-2015-4021, CVE-2015-4022, CVE-2015-4024, CVE-2015-4026, CVE-2015-4116, CVE-2015-4148, CVE-2015-4598, CVE-2015-4599, CVE-2015-4600, CVE-2015-4601, CVE-2015-4602, CVE-2015-4603, CVE-2015-4643, CVE-2015-4644, CVE-2015-5161, CVE-2015-5589, CVE-2015-5590, CVE-2015-6831, CVE-2015-6833, CVE-2015-6836, CVE-2015-6837, CVE-2015-6838, CVE-2015-7803, CVE-2015-8835, CVE-2015-8838, CVE-2015-8865, CVE-2015-8866, CVE-2015-8867, CVE-2015-8873, CVE-2015-8874, CVE-2015-8878, CVE-2015-8879, CVE-2016-2554, CVE-2016-3074, CVE-2016-3078, CVE-2016-3132, CVE-2016-3141, CVE-2016-3142, CVE-2016-3185, CVE-2016-4070, CVE-2016-4071, CVE-2016-4072, CVE-2016-4073, CVE-2016-4342, CVE-2016-4343, CVE-2016-4346, CVE-2016-4537, CVE-2016-4538, CVE-2016-4539, CVE-2016-4540, CVE-2016-4541, CVE-2016-4542, CVE-2016-4544, CVE-2016-5093, CVE-2016-5094, CVE-2016-5095, CVE-2016-5096, CVE-2016-5114

Published on 22/05/16 - Updated on 05/01/18

Description

The exif_process_IFD_in_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate IFD sizes, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.

Category: Buffer Error

CWE-119 (Buffer Errors)
The software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

Security Notices

US National Vulnerability DatabaseCVE-2016-4543
Debian DSA-3602-1
Debian LTSDLA-499-1
SUSE SUSE-SU-2016:1581, SUSE-SU-2016:1638
Ubuntu USN-2984-1

Exploits

No exploits available for this CVE in our database.

Relative technologies

VendorProduct
fedoraprojectfedora
hpsystem_management_homepage
novellleap
phpphp

Share this vulnerability with:

Twitter Facebook LinkedIn Mail