CVE-2014-3670: Buffer Overflow

Q: What is the severity of CVE-2014-3670?

CVE-2014-3670 is classified as a critical vulnerability due to potential arbitrary code execution.

Q: How do I fix CVE-2014-3670?

To fix CVE-2014-3670, upgrade your PHP installation to version 5.4.34, 5.5.18, or 5.6.2 or later.

Q: What versions of PHP are affected by CVE-2014-3670?

CVE-2014-3670 affects PHP versions prior to 5.4.34, 5.5.18, and 5.6.2.

Q: What is the potential impact of CVE-2014-3670?

The impact of CVE-2014-3670 includes crashing the PHP interpreter and potentially executing malicious code.

Q: Is CVE-2014-3670 specific to certain applications?

CVE-2014-3670 is related to the exif_thumbnail() function in PHP, which can be exploited through specially-crafted JPEG images.

Published Oct 20, 2014

Updated

A heap corruption issue was reported in PHP's exifthumbnail() function. A specially-crafted JPEG image could cause the PHP interpreter to crash or, potentially, execute arbitrary code.

This issue has been fixed in upstream versions 5.4.34, 5.5.18, and 5.6.2.

References: http://git.php.net/?p=php-src.git;a=commit;h=ddb207e7fa2e9adeba021a1303c3781efda5409b https://bugs.php.net/bug.php?id=68113 http://php.net/ChangeLog-5.php

Other sources

The exififdmakevalue function in exif.c in the EXIF extension in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 operates on floating-point arrays incorrectly, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via a crafted JPEG image with TIFF thumbnail data that is improperly handled by the exifthumbnail function.

— MITRE

Affected Software

73 affected componentsFixes available

redhat/php<5.4.34

5.4.34

redhat/php<5.5.18

5.5.18

redhat/php<5.6.2

5.6.2

PHP PHP<=5.4.33

PHP PHP=5.4.0

PHP PHP=5.4.1

PHP PHP=5.4.2

PHP PHP=5.4.3

PHP PHP=5.4.4

PHP PHP=5.4.5

PHP PHP=5.4.6

PHP PHP=5.4.7

PHP PHP=5.4.8

PHP PHP=5.4.9

PHP PHP=5.4.10

PHP PHP=5.4.11

PHP PHP=5.4.12

PHP PHP=5.4.12-rc1

PHP PHP=5.4.12-rc2

PHP PHP=5.4.13

PHP PHP=5.4.13-rc1

PHP PHP=5.4.14

PHP PHP=5.4.14-rc1

PHP PHP=5.4.15-rc1

PHP PHP=5.4.16-rc1

PHP PHP=5.4.17

PHP PHP=5.4.18

PHP PHP=5.4.19

PHP PHP=5.4.20

PHP PHP=5.4.21

PHP PHP=5.4.22

PHP PHP=5.4.23

PHP PHP=5.4.24

PHP PHP=5.4.25

PHP PHP=5.4.26

PHP PHP=5.4.27

PHP PHP=5.4.28

PHP PHP=5.4.29

PHP PHP=5.4.30

PHP PHP=5.4.31

PHP PHP=5.4.32

PHP PHP=5.5.0

PHP PHP=5.5.0-alpha1

PHP PHP=5.5.0-alpha2

PHP PHP=5.5.0-alpha3

PHP PHP=5.5.0-alpha4

PHP PHP=5.5.0-alpha5

PHP PHP=5.5.0-alpha6

PHP PHP=5.5.0-beta1

PHP PHP=5.5.0-beta2

PHP PHP=5.5.0-beta3

PHP PHP=5.5.0-beta4

PHP PHP=5.5.0-rc1

PHP PHP=5.5.0-rc2

PHP PHP=5.5.1

PHP PHP=5.5.2

PHP PHP=5.5.3

PHP PHP=5.5.4

PHP PHP=5.5.5

PHP PHP=5.5.6

PHP PHP=5.5.7

PHP PHP=5.5.8

PHP PHP=5.5.9

PHP PHP=5.5.10

PHP PHP=5.5.11

PHP PHP=5.5.12

PHP PHP=5.5.13

PHP PHP=5.5.14

PHP PHP=5.5.15

PHP PHP=5.5.16

PHP PHP=5.5.17

PHP PHP=5.6.0

PHP PHP=5.6.1

Remediation

Patch Available

https://bugs.php.net/bug.php?id=68113

Event History

Oct 29, 2014

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2014-3670?