CVE-2009-2687: Input Validation
Published Aug 5, 2009
·Updated
The exifreaddata function in the Exif module in PHP before 5.2.10 allows remote attackers to cause a denial of service (crash) via a malformed JPEG image with invalid offset fields, a different issue than CVE-2005-3353.
Affected Software
4 affected components
PHP PHP<5.2.10
Debian Debian Linux=5.0
Debian Debian Linux=4.0
Debian Debian Linux=6.0
Remediation
Patch Available
Patch Available
Patch Available
Event History
Aug 5, 2009
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2009-2687?
CVE-2009-2687 is considered a denial of service vulnerability, allowing attackers to crash the PHP application.
2
How do I fix CVE-2009-2687?
To fix CVE-2009-2687, upgrade to PHP version 5.2.10 or later.
3
What causes CVE-2009-2687?
CVE-2009-2687 is caused by the exif_read_data function processing malformed JPEG images with invalid offset fields.
4
Which versions of PHP are affected by CVE-2009-2687?
CVE-2009-2687 affects PHP versions prior to 5.2.10.
5
Is CVE-2009-2687 related to any other vulnerabilities?
CVE-2009-2687 is a different issue than CVE-2005-3353, although both involve vulnerabilities in the PHP Exif module.