CVE-2011-0708

Published: Mar 20, 2011Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

exif.c in the Exif extension in PHP before 5.3.6 on 64-bit platforms performs an incorrect cast, which allows remote attackers to cause a denial of service (application crash) via an image with a crafted Image File Directory (IFD) that triggers a buffer over-read.

Affected (110)

Products: Php: Php

1 product

Configuration A

110 vulnerable

Vulnerable Software	Affected Versions
Php Php	Up to 5.3.5
Php Php	Version 1.0
Php Php	Version 2.0
Php Php	Version 2.0b10
Php Php	Version 3.0.10
Php Php	Version 3.0.11
Php Php	Version 3.0.12
Php Php	Version 3.0.13
Php Php	Version 3.0.14
Php Php	Version 3.0.15
Php Php	Version 3.0.16
Php Php	Version 3.0.17
Php Php	Version 3.0.18
Php Php	Version 3.0.1
Php Php	Version 3.0.2
Php Php	Version 3.0.3
Php Php	Version 3.0.4
Php Php	Version 3.0.5
Php Php	Version 3.0.6
Php Php	Version 3.0.7
Php Php	Version 3.0.8
Php Php	Version 3.0.9
Php Php	Version 3.0
Php Php	Version 4.0.0
Php Php	Version 4.0.1
Php Php	Version 4.0.2
Php Php	Version 4.0.3
Php Php	Version 4.0.4
Php Php	Version 4.0.5
Php Php	Version 4.0.6
Php Php	Version 4.0.7
Php Php	Version 4.0
Php Php	Version 4.0 beta1
Php Php	Version 4.0 beta2
Php Php	Version 4.0 beta3
Php Php	Version 4.0 beta4
Php Php	Version 4.0 beta_4_patch1
Php Php	Version 4.1.0
Php Php	Version 4.1.1
Php Php	Version 4.1.2
Php Php	Version 4.2.0
Php Php	Version 4.2.1
Php Php	Version 4.2.2
Php Php	Version 4.2.3
Php Php	Version 4.3.0
Php Php	Version 4.3.10
Php Php	Version 4.3.11
Php Php	Version 4.3.1
Php Php	Version 4.3.2
Php Php	Version 4.3.3
Php Php	Version 4.3.4
Php Php	Version 4.3.5
Php Php	Version 4.3.6
Php Php	Version 4.3.7
Php Php	Version 4.3.8
Php Php	Version 4.3.9
Php Php	Version 4.4.0
Php Php	Version 4.4.1
Php Php	Version 4.4.2
Php Php	Version 4.4.3
Php Php	Version 4.4.4
Php Php	Version 4.4.5
Php Php	Version 4.4.6
Php Php	Version 4.4.7
Php Php	Version 4.4.8
Php Php	Version 4.4.9
Php Php	Version 5.0.0
Php Php	Version 5.0.0 beta1
Php Php	Version 5.0.0 beta2
Php Php	Version 5.0.0 beta3
Php Php	Version 5.0.0 beta4
Php Php	Version 5.0.0 rc1
Php Php	Version 5.0.0 rc2
Php Php	Version 5.0.0 rc3
Php Php	Version 5.0.1
Php Php	Version 5.0.2
Php Php	Version 5.0.3
Php Php	Version 5.0.4
Php Php	Version 5.0.5
Php Php	Version 5.1.0
Php Php	Version 5.1.1
Php Php	Version 5.1.2
Php Php	Version 5.1.3
Php Php	Version 5.1.4
Php Php	Version 5.1.5
Php Php	Version 5.1.6
Php Php	Version 5.2.0
Php Php	Version 5.2.10
Php Php	Version 5.2.11
Php Php	Version 5.2.12
Php Php	Version 5.2.13
Php Php	Version 5.2.14
Php Php	Version 5.2.15
Php Php	Version 5.2.16
Php Php	Version 5.2.17
Php Php	Version 5.2.1
Php Php	Version 5.2.2
Php Php	Version 5.2.3
Php Php	Version 5.2.4
Php Php	Version 5.2.4
Php Php	Version 5.2.5
Php Php	Version 5.2.6
Php Php	Version 5.2.7
Php Php	Version 5.2.8
Php Php	Version 5.2.9
Php Php	Version 5.3.0
Php Php	Version 5.3.1
Php Php	Version 5.3.2
Php Php	Version 5.3.3
Php Php	Version 5.3.4

Related CWEs

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (50)

http://bugs.php.net/bug.php?id=54002

Source: secalert@redhat.com

http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057709.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057710.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056642.html

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=133469208622507&w=2

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2011/02/14/1

Source: secalert@redhat.com

Exploit

http://openwall.com/lists/oss-security/2011/02/16/7

Source: secalert@redhat.com

Patch

http://rhn.redhat.com/errata/RHSA-2012-0071.html

Source: secalert@redhat.com

http://securityreason.com/securityalert/8114

Source: secalert@redhat.com

http://support.apple.com/kb/HT5002

Source: secalert@redhat.com

http://svn.php.net/viewvc?view=revision&revision=308316

Source: secalert@redhat.com

Patch

http://www.debian.org/security/2011/dsa-2266

Source: secalert@redhat.com

http://www.exploit-db.com/exploits/16261/

Source: secalert@redhat.com

Exploit

http://www.mandriva.com/security/advisories?name=MDVSA-2011:052

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2011:053

Source: secalert@redhat.com

http://www.php.net/ChangeLog-5.php

Source: secalert@redhat.com

http://www.php.net/archive/2011.php

Source: secalert@redhat.com

http://www.php.net/releases/5_3_6.php

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2011-1423.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/46365

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2011/0744

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2011/0764

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2011/0890

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=680972

Source: secalert@redhat.com

ExploitPatch

http://bugs.php.net/bug.php?id=54002

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057709.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057710.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056642.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://marc.info/?l=bugtraq&m=133469208622507&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

http://openwall.com/lists/oss-security/2011/02/14/1

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://openwall.com/lists/oss-security/2011/02/16/7

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://rhn.redhat.com/errata/RHSA-2012-0071.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://securityreason.com/securityalert/8114

Source: af854a3a-2127-422b-91ae-364da2661108

http://support.apple.com/kb/HT5002

Source: af854a3a-2127-422b-91ae-364da2661108

http://svn.php.net/viewvc?view=revision&revision=308316

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://www.debian.org/security/2011/dsa-2266

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.exploit-db.com/exploits/16261/

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://www.mandriva.com/security/advisories?name=MDVSA-2011:052

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDVSA-2011:053

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.php.net/ChangeLog-5.php

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.php.net/archive/2011.php

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.php.net/releases/5_3_6.php

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.redhat.com/support/errata/RHSA-2011-1423.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/46365

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2011/0744

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2011/0764

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2011/0890

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=680972

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

Timeline

No history available yet.