NetSight
IP …
critical9.8

CVE-2016-4543

The exif_process_IFD_in_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate IFD sizes, which all…

Impact

The exif_process_IFD_in_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate IFD sizes, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.

Affected products

VendorProductAffected versions
HpSystem Management Homepage
through 7.5.5.6
PhpPhp
through 5.5.34
Versions 5.6.0, 5.6.1, 5.6.2, 5.6.3, 5.6.4
FedoraprojectFedora
Version 24
OpensuseLeap
Version 42.1

Weakness classification

CWE-119

References