CVE-2005-0525: Medium severity PHP PHP vulnerability
Published Apr 3, 2005
·Updated
The phpnextmarker function in image.c for PHP 4.2.2, 4.3.9, 4.3.10 and 5.0.3, as reachable by the getimagesize PHP function, allows remote attackers to cause a denial of service (infinite loop) via a JPEG image with an invalid marker value, which causes a negative length value to be passed to phpstreamseek.
Affected Software
4 affected components
PHP PHP=4.3.9
PHP PHP=4.2.2
PHP PHP=5.0.3
PHP PHP=4.3.10
Remediation
Patch Available
Patch Available
Event History
Apr 3, 2005
CVE Published
via MITRE·09:00 AM
Data Sourced
via MITRE·09:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2005-0525?
CVE-2005-0525 is classified as a denial of service vulnerability.
2
How do I fix CVE-2005-0525?
To fix CVE-2005-0525, upgrade PHP to a version later than 5.0.3, 4.3.10, or 4.3.9.
3
What types of PHP are affected by CVE-2005-0525?
CVE-2005-0525 affects PHP versions 4.2.2, 4.3.9, 4.3.10, and 5.0.3.
4
What is the impact of CVE-2005-0525 on web applications?
CVE-2005-0525 can lead to an infinite loop causing applications to become unresponsive, resulting in service denial.
5
Can CVE-2005-0525 be exploited remotely?
Yes, CVE-2005-0525 can be exploited remotely through crafted JPEG images.