Heap-based buffer overflow in PHP - CVE-2014-3670
Published: November 27, 2018
Vulnerability identifier: #VU16099
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2014-3670
CWE-ID: CWE-122
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to heap-based buffer overflow when exif_ifd_make_value function in exif.c in the EXIF extension in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 operates on floating-point arrays incorrectly. A remote attacker can trigger memory corruption via a crafted JPEG image with TIFF thumbnail data that is improperly handled by the exif_thumbnail function and cause the application to crash or execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
PHP
Gentoo Linux
Amazon Linux AMI
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux EUS Compute Node
Slackware Linux
Fedora
php5 (Ubuntu package)
php
Gentoo Linux
Amazon Linux AMI
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux EUS Compute Node
Slackware Linux
Fedora
php5 (Ubuntu package)
php
How to mitigate CVE-2014-3670
Install update from vendor's website.
PHP - addressed in versions 5.4.34, 5.5.18, 5.6.2
php5 (Ubuntu package) - addressed in versions 5.3.2-1ubuntu4.28, 5.3.10-1ubuntu3.15
php - update to 5.6.2-1.fc21
php5 (Ubuntu package) - addressed in versions 5.3.2-1ubuntu4.28, 5.3.10-1ubuntu3.15
php - update to 5.6.2-1.fc21