Memory corruption in PHP - CVE-2018-10549

Vulnerability identifier: #VU12258

CSH Severity: Low

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-10549

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in exif_read_data() function due to an out-of-bounds read while processing crafted JPEG data. A remote attacker can supply a specially image file, trigger heap-based buffer overflow in exif_iif_add_value and cause the service to crash.

PHP
Amazon Linux AMI
Debian Linux
Gentoo Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power
Slackware Linux
Fedora
php7 (Alpine package)
php

The vulnerability is addressed in the following versions: 5.6.36, 7.1.17, 7.2.5 and 7.0.30.

php7 (Alpine package) - update to 7.1.30-r0
php - addressed in versions 7.1.17-1.fc26, 7.1.17-1.fc27, 7.2.5-1.fc28

• https://bugs.php.net/bug.php?id=76130

• Multiple vulnerabilities in PHP
• Amazon Linux AMI update for php56, php70, php71
• Slackware Linux update for php
• Debian update for php7.0
• Gentoo update for PHP
• Red Hat update for 389-ds-base
• Red Hat update for 389-ds-base
• Memory corruption in php7 (Alpine package)
• Fedora 28 update for php
• Fedora 27 update for php
• Fedora 26 update for php