MGASA-2019-0095 Updated libexif packages fix security vulnerability

It was found that specially crafted XIFIFDINTEROPERABILITY and EXIFIFDEXIF tags could be used for a denial of service CVE-2018-20030...

Code injection

An error when processing the EXIFIFDINTEROPERABILITY and EXIFIFDEXIF tags within libexif version 0.6.21 can be exploited to exhaust available CPU resources...

CVE-2018-20030

An error when processing the EXIFIFDINTEROPERABILITY and EXIFIFDEXIF tags within libexif version 0.6.21 can be exploited to exhaust available CPU resources...

UBUNTU-CVE-2018-20030

An error when processing the EXIFIFDINTEROPERABILITY and EXIFIFDEXIF tags within libexif version 0.6.21 can be exploited to exhaust available CPU resources...

ALPINE-CVE-2018-20030

An error when processing the EXIFIFDINTEROPERABILITY and EXIFIFDEXIF tags within libexif version 0.6.21 can be exploited to exhaust available CPU resources...

DEBIAN-CVE-2018-20030

An error when processing the EXIFIFDINTEROPERABILITY and EXIFIFDEXIF tags within libexif version 0.6.21 can be exploited to exhaust available CPU resources...

CVE-2018-20030

The CVE affects libexif 0.6.21, where processing EXIF_IFD_INTEROPERABILITY and EXIF_IFD_EXIF tags could be exploited to exhaust CPU resources, causing a Denial of Service. Multiple connected advisories note this as a fixed issue in newer libexif packages and recommend upgrading to patched release...

CVE-2019-8942

WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an wpattachedfile Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image...

CVE-2019-8942

WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an wpattachedfile Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image...

DEBIAN-CVE-2019-8942

WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an wpattachedfile Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image...

Remote code execution

WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an wpattachedfile Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image...

UBUNTU-CVE-2019-8942

WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an wpattachedfile Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image...

CVE-2019-8942

WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an wpattachedfile Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image...

CVE-2019-8942

WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an wpattachedfile Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image...

Wordpress Post Meta Entry RCE

Exploiting a local file inclusion vulnerability and directory traversal vulnerability in Wordpress versions 5.0.0 and prior to v4.9.9 can result in RCE. Recent assessments: space-r7 at May 09, 2019 5:57pm UTC reported: Details This exploit requires authentication and either the php-imagick or...

CVE-2019-8942: Unrestricted Upload of File with Dangerous Type

WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an wpattachedfile Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image...

PT-2019-19273

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.9.9 WordPress versions 5.x prior to 5.0.1 Description The issue allows remote code execution. An attacker with author privileges can execute arbitrary code by uploading a crafted image containing PHP code in the...

[SECURITY] Fedora 29 Update: libexif-0.6.21-19.fc29

Most digital cameras produce EXIF files, which are JPEG files with extra tags that contain information about the image. The EXIF library allows you to parse an EXIF file and read the data from those tags...

PHP 7.0.x < 7.0.31 Use After Free Arbitrary Code Execution in EXIF

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.31 or 7.2.x prior to 7.2.8 . It is, therefore, affected by a use after free arbitrary code execution vulnerability. Note that the scanner has not tested for these issues but has instead relied only ...

PHP 7.2.x < 7.2.8 Use After Free Arbitrary Code Execution in EXIF

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.31 or 7.2.x prior to 7.2.8 . It is, therefore, affected by a use after free arbitrary code execution vulnerability. Note that the scanner has not tested for these issues but has instead relied only ...