9.8

CVE-2016-6291

Exploit
The exif_process_IFD_in_MAKERNOTE function in ext/exif/exif.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (out-of-bounds array access and memory corruption), obtain sensitive information from process memory, or possibly have unspecified other impact via a crafted JPEG image.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Php ≫ Php Version <= 5.5.37
Php ≫ Php Version5.6.0 Updatealpha1
Php ≫ Php Version5.6.0 Updatealpha2
Php ≫ Php Version5.6.0 Updatealpha3
Php ≫ Php Version5.6.0 Updatealpha4
Php ≫ Php Version5.6.0 Updatealpha5
Php ≫ Php Version5.6.0 Updatebeta1
Php ≫ Php Version5.6.0 Updatebeta2
Php ≫ Php Version5.6.0 Updatebeta3
Php ≫ Php Version5.6.0 Updatebeta4
Php ≫ Php Version5.6.1
Php ≫ Php Version5.6.2
Php ≫ Php Version5.6.3
Php ≫ Php Version5.6.4
Php ≫ Php Version5.6.5
Php ≫ Php Version5.6.6
Php ≫ Php Version5.6.7
Php ≫ Php Version5.6.8
Php ≫ Php Version5.6.9
Php ≫ Php Version5.6.10
Php ≫ Php Version5.6.11
Php ≫ Php Version5.6.12
Php ≫ Php Version5.6.13
Php ≫ Php Version5.6.14
Php ≫ Php Version5.6.15
Php ≫ Php Version5.6.16
Php ≫ Php Version5.6.17
Php ≫ Php Version5.6.18
Php ≫ Php Version5.6.19
Php ≫ Php Version5.6.20
Php ≫ Php Version5.6.21
Php ≫ Php Version5.6.22
Php ≫ Php Version5.6.23
Php ≫ Php Version7.0.0
Php ≫ Php Version7.0.1
Php ≫ Php Version7.0.2
Php ≫ Php Version7.0.3
Php ≫ Php Version7.0.4
Php ≫ Php Version7.0.5
Php ≫ Php Version7.0.8
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 5.6% 0.919
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

http://php.net/ChangeLog-5.php
Release Notes
http://rhn.redhat.com/errata/RHSA-2016-2750.html
http://php.net/ChangeLog-7.php
Release Notes
http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html
https://support.apple.com/HT207170
https://security.gentoo.org/glsa/201611-22
http://www.debian.org/security/2016/dsa-3631
http://openwall.com/lists/oss-security/2016/07/24/2
Mailing List
http://www.securitytracker.com/id/1036430
http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=eebcbd5de38a0f1c2876035402cb770e37476519
http://www.securityfocus.com/bid/92073
Third Party Advisory
VDB Entry
https://bugs.php.net/72603
Patch
Third Party Advisory
Exploit
Issue Tracking