Lucene search

MitreCVE-2011-4566

HistoryNov 29, 2011 - 12:55 a.m.

CVE-2011-4566

2011-11-2900:55:01

CWE-189

mitre

web.nvd.nist.gov

190

cve-2011-4566

integer overflow

exif_process_ifd_tag

php

remote attackers

memory locations

denial of service

crafted offset_val

exif header

jpeg file

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:N/A:P

AI Score

8.5

Confidence

High

EPSS

0.882

Percentile

98.7%

JSON

Integer overflow in the exif_process_IFD_TAG function in exif.c in the exif extension in PHP 5.4.0beta2 on 32-bit platforms allows remote attackers to read the contents of arbitrary memory locations or cause a denial of service via a crafted offset_val value in an EXIF header in a JPEG file, a different vulnerability than CVE-2011-0708.

Affected configurations

Nvd

Node

phpphpRange5.3.0–5.3.9

phpphpMatch5.4.0beta2

Node

debiandebian_linuxMatch5.0

debiandebian_linuxMatch6.0

debiandebian_linuxMatch7.0

Node

canonicalubuntu_linuxMatch8.04-

canonicalubuntu_linuxMatch10.04-

canonicalubuntu_linuxMatch10.10

canonicalubuntu_linuxMatch11.04

canonicalubuntu_linuxMatch11.10

VendorProductVersionCPE
phpphp*cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
phpphp5.4.0cpe:2.3:a:php:php:5.4.0:beta2:*:*:*:*:*:*
debiandebian_linux5.0cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*
debiandebian_linux6.0cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*
debiandebian_linux7.0cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
canonicalubuntu_linux8.04cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*
canonicalubuntu_linux10.04cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*
canonicalubuntu_linux10.10cpe:2.3:o:canonical:ubuntu_linux:10.10:*:*:*:*:*:*:*
canonicalubuntu_linux11.04cpe:2.3:o:canonical:ubuntu_linux:11.04:*:*:*:*:*:*:*
canonicalubuntu_linux11.10cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
php	php	*	cpe:2.3:a:php:php::::::::
php	php	5.4.0	cpe:2.3:a:php:php:5.4.0:beta2::::::
debian	debian_linux	5.0	cpe:2.3:o:debian:debian_linux:5.0:::::::*
debian	debian_linux	6.0	cpe:2.3:o:debian:debian_linux:6.0:::::::*
debian	debian_linux	7.0	cpe:2.3:o:debian:debian_linux:7.0:::::::*
canonical	ubuntu_linux	8.04	cpe:2.3:o:canonical:ubuntu_linux:8.04::::-:::
canonical	ubuntu_linux	10.04	cpe:2.3:o:canonical:ubuntu_linux:10.04::::-:::
canonical	ubuntu_linux	10.10	cpe:2.3:o:canonical:ubuntu_linux:10.10:::::::*
canonical	ubuntu_linux	11.04	cpe:2.3:o:canonical:ubuntu_linux:11.04:::::::*
canonical	ubuntu_linux	11.10	cpe:2.3:o:canonical:ubuntu_linux:11.10:::::::*