PHP 7.1.x < 7.1.28 Multiple Vulnerabilities

According to its banner, the version of PHP running on the remote web server is 7.1.x prior to 7.1.28, 7.2.x prior to 7.2.17 or 7.3.x prior to 7.3.4. It is, therefore, affected by multiple vulnerabilities: - A heap-based buffer over-read condition exists in phpifdget32s in exif.c. - A heap-based...

PHP 7.3.x < 7.3.3 Multiple vulnerabilities.

According to its banner, the version of PHP running on the remote web server is 7.3.x prior to 7.3.3. It is, therefore, affected by multiple vulnerabilities: - Uninitialized reads in the EXIF component of PHP due to the mishandling of data in exifprocessIFDinMAKERNOTE, and exifprocessIFDinTIFF...

PHP 7.1.x < 7.1.27 Multiple vulnerabilities.

According to its banner, the version of PHP running on the remote web server is 7.1.x prior to 7.1.27. It is, therefore, affected by multiple vulnerabilities: - Uninitialized reads in the EXIF component of PHP due to the mishandling of data in exifprocessIFDinMAKERNOTE, and exifprocessIFDinTIFF...

PHP 7.2.x < 7.2.16 Multiple vulnerabilities.

According to its banner, the version of PHP running on the remote web server is 7.2.x prior to 7.2.16. It is, therefore, affected by multiple vulnerabilities: - Uninitialized reads in the EXIF component of PHP due to the mishandling of data in exifprocessIFDinMAKERNOTE, and exifprocessIFDinTIFF...

SUSE SLES11 Security Update : php53 (SUSE-SU-2019:14013-1)

This update for php53 fixes the following issues : Security issues fixed : CVE-2019-9637: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension bsc1128892. CVE-2019-9675: Fixed improper implementation of rename function and multiple invalid memory...

SUSE-SU-2019:14013-1 Security update for php53

This update for php53 fixes the following issues: Security issues fixed: - CVE-2019-9637: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension bsc1128892. - CVE-2019-9675: Fixed improper implementation of rename function and multiple invalid memory...

php/php-fuzz-exif: Heap-buffer-overflow in _estrndup

Detailed report: https://oss-fuzz.com/testcase?key=5740255098961920 Project: php Fuzzer: libFuzzerphpphp-fuzz-exif Fuzz target binary: php-fuzz-exif Job Type: libfuzzerasanphp Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address: 0x6120000032e0 Crash State: estrndup...

PHP 7.3.x < 7.3.4 Multiple vulnerabilities.

According to its banner, the version of PHP running on the remote web server is 7.3.x prior to 7.3.4. It is, therefore, affected by multiple vulnerabilities: - A heap-based buffer over-read condition exists in phpifdget32s in exif.c. - A heap-based buffer overflow condition exists in...

PHP -- Multiple vulnerabilities in EXIF module

The PHP project reports: Heap-buffer-overflow in phpifdget32s CVE-2019-11034 Heap-buffer-overflow in exifiifaddvalue CVE-2019-11035...

The vulnerability of the exif_process_IFD_in_MAKERNOTE module in the PHP programming language, related to reading beyond buffer boundaries, allows attackers to cause service failures.

The vulnerability of the exifprocessIFDinMAKERNOTE module located in ext/exif/exif.c in the PHP programming language is related to incorrect image processing. Exploiting this vulnerability can allow a malicious actor to cause service failures through a specially created JPEG file...

The vulnerability of the PHP programming language module exif_thumbnail_extract, related to integer overflow, allows attackers to cause a service failure.

The vulnerability of the exifthumbnailextract module in the PHP programming language is related to a numerical overflow in the buffer-based queue. Exploiting this vulnerability can allow an attacker to cause service failures...

FreeBSD : Gitlab -- Multiple vulnerabilities (da459dbc-5586-11e9-abd6-001b217b3468)

Gitlab reports : DoS potential for regex in CI/CD refs Related branches visible in issues for guests Persistent XSS at merge request resolve conflicts Improper authorization control 'move issue' Guest users of private projects have access to releases DoS potential on project languages page Recuri...

EulerOS 2.0 SP2 : libexif (EulerOS-SA-2019-1116)

According to the versions of the libexif package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Most digital cameras produce EXIF files, which are JPEG files with extra tags that contain information about the image. The EXIF library allows...

Gitlab -- Multiple vulnerabilities

Gitlab reports: DoS potential for regex in CI/CD refs Related branches visible in issues for guests Persistent XSS at merge request resolve conflicts Improper authorization control "move issue" Guest users of private projects have access to releases DoS potential on project languages page Recurit...

openSUSE Security Update : jhead (openSUSE-2019-698)

This update for jhead fixes the following security issues : - CVE-2016-3822: jhead remote attackers to execute arbitrary code or cause a denial of service out-of-bounds access via crafted EXIF data bsc1108480. - CVE-2018-16554: The ProcessGpsInfo function may have allowed a remote attacker to cau...

openSUSE Security Update : ImageMagick (openSUSE-2019-419)

This update for ImageMagick to version 7.0.7-34 fixes the following issues : The following security issue was fixed : - Fixed numerous use of uninitialized values, integer overflow, memory exceeded, and timeouts. The following non-security issues were fixed : - Added support for reading eXIf chun...

EulerOS 2.0 SP3 : libexif (EulerOS-SA-2019-1095)

According to the versions of the libexif package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Most digital cameras produce EXIF files, which are JPEG files with extra tags that contain information about the image. The EXIF library allows...

php/php-fuzz-exif: Heap-buffer-overflow in php_ifd_get32s

Detailed report: https://oss-fuzz.com/testcase?key=5684144401547264 Project: php Fuzzer: libFuzzerphpphp-fuzz-exif Fuzz target binary: php-fuzz-exif Job Type: libfuzzerasanphp Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x60f0000014a1 Crash State: phpifdget32s...

Fedora 29 : php (2019-f187a4df7a)

PHP version 7.2.16 07 Mar 2019 Core: - Fixed bug php77589 Core dump using parseinistring with numeric sections. Laruence - Fixed bug php77630 rename across the device may allow unwanted access during processing. Stas EXIF: - Fixed bug php77509 Uninitialized read in exifprocessIFDinTIFF. Stas -...

Fedora 28 : php (2019-efa799fd16)

PHP version 7.2.16 07 Mar 2019 Core: - Fixed bug php77589 Core dump using parseinistring with numeric sections. Laruence - Fixed bug php77630 rename across the device may allow unwanted access during processing. Stas EXIF: - Fixed bug php77509 Uninitialized read in exifprocessIFDinTIFF. Stas -...