Fluid Attacks Database

Description

A buffer overflow flaw was found in the Exif extension. A specially crafted JPEG or TIFF file could cause a PHP application using the exif_thumbnail() function to crash or, possibly, execute arbitrary code with the privileges of the user running that PHP application.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
rpm rhel5	php53	<0:5.3.3-26.el5_11	0:5.3.3-26.el5_11
rpm rhel5	php	<0:5.1.6-45.el5_11	0:5.1.6-45.el5_11
rpm rhel6.5	php	<0:5.3.3-27.el6_5.3	0:5.3.3-27.el6_5.3
rpm rhel7	php	<0:5.4.16-23.el7_0.3	0:5.4.16-23.el7_0.3
rpm rhel6	php	<0:5.3.3-40.el6_6	0:5.3.3-40.el6_6

Aliases

1. CVE-2014-36702. NVD-2014-36703. OSV-2014-3670

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.