medium
4.3
CWE
20 190 119
Advisory Published
CVE Published
Updated

CVE-2011-0708: Input Validation

First published: Mon Feb 28 2011(Updated: )

An insufficient input validation flaws was discovered in the PHP's Exif extension that allows extracting Exif data from image files: <a href="http://thread.gmane.org/gmane.comp.security.oss.general/4198">http://thread.gmane.org/gmane.comp.security.oss.general/4198</a> An integer overflow causes PHP to not validate offsets read from the file properly, causing it to read behind the end of the buffer. This leads to PHP interpreter crash when reading specially crafted Exif data. Before the code over-reading the buffer is reached, PHP needs to allocate a large amount of memory (based on the components / length value read from the file). This attempt triggers the integer overflow check in safe_emalloc on 32bit platforms and requires the memory_limit for the script to be set to -1 (i.e. no limit is enforced by PHP) on 64bit platforms. Upstream commits, which include reproducers: <a href="http://svn.php.net/viewvc?view=revision&amp;revision=308316">http://svn.php.net/viewvc?view=revision&amp;revision=308316</a> <a href="http://svn.php.net/viewvc?view=revision&amp;revision=308317">http://svn.php.net/viewvc?view=revision&amp;revision=308317</a> The follow-up commit replaces the use of hard-coded numeric constant with INT32_MAX: <a href="http://svn.php.net/viewvc?view=revision&amp;revision=308362">http://svn.php.net/viewvc?view=revision&amp;revision=308362</a> This fix should first appear in upstream version 5.3.6.

Credit: secalert@redhat.com

Affected SoftwareAffected VersionHow to fix
PHP=4.3.9
PHP=4.4.9
PHP=3.0
PHP=5.2.9
PHP=4.0-beta1
PHP=3.0.5
PHP=3.0.11
PHP=5.2.4
PHP=5.1.5
PHP=5.1.2
PHP=4.0-beta4
PHP=5.3.1
PHP=4.2.0
PHP=5.1.1
PHP=3.0.1
PHP=5.2.14
PHP=3.0.2
PHP=4.4.4
PHP=5.0.0-beta1
PHP=4.1.0
PHP=5.1.6
PHP=5.2.16
PHP=4.3.4
PHP=4.0.4
PHP=4.3.0
PHP=4.0.5
PHP=5.2.7
PHP=5.2.2
PHP=3.0.8
PHP=5.0.5
PHP=4.3.6
PHP=3.0.13
PHP=5.0.1
PHP=5.1.4
PHP=5.2.5
PHP=4.3.7
PHP=5.0.4
PHP=4.2.2
PHP=4.4.2
PHP=5.2.12
PHP=3.0.7
PHP=4.3.2
PHP=4.3.11
PHP=4.0.0
PHP=3.0.6
PHP=3.0.17
PHP=4.0.7
PHP=4.0.2
PHP=4.3.3
PHP=2.0
PHP=4.1.1
PHP=3.0.15
PHP=3.0.16
PHP=5.2.11
PHP=5.2.6
PHP=5.2.17
PHP=5.3.0
PHP=4.4.3
PHP=5.0.0-rc2
PHP=5.2.3
PHP=5.3.3
PHP=5.0.3
PHP=3.0.10
PHP=3.0.4
PHP=4.2.3
PHP=5.1.0
PHP=4.4.5
PHP=5.2.13
PHP=5.0.0-rc3
PHP=4.0
PHP=4.0-beta2
PHP=2.0b10
PHP=4.4.8
PHP=4.0.6
PHP=5.2.0
PHP=5.2.4
PHP=4.1.2
PHP=5.0.0-beta3
PHP=5.3.2
PHP<=5.3.5
PHP=5.3.4
PHP=4.3.1
PHP=5.1.3
PHP=3.0.18
PHP=4.0-beta_4_patch1
PHP=4.4.0
PHP=5.2.10
PHP=4.3.10
PHP=4.2.1
PHP=5.0.0-rc1
PHP=4.0.1
PHP=1.0
PHP=5.0.2
PHP=4.4.6
PHP=3.0.12
PHP=5.2.15
PHP=4.4.1
PHP=4.0-beta3
PHP=5.2.1
PHP=4.0.3
PHP=3.0.14
PHP=3.0.9
PHP=3.0.3
PHP=5.0.0-beta4
PHP=5.0.0
PHP=4.3.8
PHP=4.3.5
PHP=5.0.0-beta2
PHP=5.2.8
PHP=4.4.7

Remedy

http://openwall.com/lists/oss-security/2011/02/16/7

Remedy

http://svn.php.net/viewvc?view=revision&revision=308316

Remedy

https://bugzilla.redhat.com/show_bug.cgi?id=680972

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203