NetSight
IP …
high8.8

CVE-2018-10549

An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5.

Impact

An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. exif_read_data in ext/exif/exif.c has an out-of-bounds read for crafted JPEG data because exif_iif_add_value mishandles the case of a MakerNote that lacks a final '\0' character.

Affected products

VendorProductAffected versions
PhpPhp
before 5.6.36
from 7.0.0 before 7.0.30
from 7.1.0 before 7.1.17
from 7.2.0 before 7.2.5
CanonicalUbuntu Linux
Versions 16.04, 17.10, 18.04
DebianDebian Linux
Versions 8.0, 9.0
NetappStorage Automation Store
All versions

Weakness classification

CWE-125

References