Vulnerability identifier: #VU33365
Vulnerability risk: Medium
CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-416
Exploitation vector: Network
Exploit availability: No
Description
The vulnerability allows a remote non-authenticated attacker to #BASIC_IMPACT#.
When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.
Mitigation
Install update from vendor's website.
External links
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00036.html
http://bugs.php.net/bug.php?id=78793
http://lists.debian.org/debian-lts-announce/2019/12/msg00034.html
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/
http://seclists.org/bugtraq/2020/Feb/27
http://seclists.org/bugtraq/2020/Feb/31
http://security.netapp.com/advisory/ntap-20200103-0002/
http://usn.ubuntu.com/4239-1/
http://www.debian.org/security/2020/dsa-4626
http://www.debian.org/security/2020/dsa-4628
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.