CVE-2016-4542: Buffer Overflow
Fixed bug (Out of bounds heap read access in exif header processing). (CVE-2016-4542, CVE-2016-4543, CVE-2016-4544)
Other sources
The exifprocessIFDTAG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not properly construct spprintf arguments, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2016-4542?
CVE-2016-4542 is a vulnerability in PHP before version 7.0.6 that allows remote attackers to cause a denial of service or possibly have other unspecified impact via crafted exif headers.
How severe is CVE-2016-4542?
CVE-2016-4542 has a severity score of 9.8, which is considered critical.
Which versions of PHP are affected by CVE-2016-4542?
PHP versions before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 are affected by CVE-2016-4542.
How can I fix CVE-2016-4542?
To fix CVE-2016-4542, you should upgrade PHP to version 7.0.6 or apply the appropriate patch provided by the PHP project.
Where can I find more information about CVE-2016-4542?
You can find more information about CVE-2016-4542 in the PHP ChangeLog and the OSS Security mailing list.