CVE-2016-6292: Null Pointer Dereference

Q: What is the severity of CVE-2016-6292?

CVE-2016-6292 is considered a moderate severity vulnerability due to its potential to cause denial of service through a NULL pointer dereference.

Q: How do I fix CVE-2016-6292?

To fix CVE-2016-6292, update PHP to versions 5.5.38, 5.6.24, or 7.0.9 or later.

Q: What are the affected PHP versions for CVE-2016-6292?

CVE-2016-6292 affects PHP versions prior to 5.5.38, all versions of 5.6 before 5.6.24, and all versions before 7.0.9.

Q: What type of attack does CVE-2016-6292 enable?

CVE-2016-6292 enables remote attackers to execute a denial of service attack, causing application crashes.

Q: Is it safe to use PHP versions after the fixes for CVE-2016-6292?

Yes, PHP versions 5.5.38, 5.6.24, and 7.0.9 or later are considered safe from the vulnerabilities introduced by CVE-2016-6292.

Published Jul 25, 2016

Updated

The exifprocessusercomment function in ext/exif/exif.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted JPEG image.

Other sources

Fixed bug (NULL Pointer Dereference in exifprocessusercomment). (CVE-2016-6292)

— PHP

Affected Software

41 affected componentsFixes available

PHP PHP<=5.5.37

PHP PHP=5.6.0-alpha1

PHP PHP=5.6.0-alpha2

PHP PHP=5.6.0-alpha3

PHP PHP=5.6.0-alpha4

PHP PHP=5.6.0-alpha5

PHP PHP=5.6.0-beta1

PHP PHP=5.6.0-beta2

PHP PHP=5.6.0-beta3

PHP PHP=5.6.0-beta4

PHP PHP=5.6.1

PHP PHP=5.6.2

PHP PHP=5.6.3

PHP PHP=5.6.4

PHP PHP=5.6.5

PHP PHP=5.6.6

PHP PHP=5.6.7

PHP PHP=5.6.8

PHP PHP=5.6.9

PHP PHP=5.6.10

PHP PHP=5.6.11

PHP PHP=5.6.12

PHP PHP=5.6.13

PHP PHP=5.6.14

PHP PHP=5.6.15

PHP PHP=5.6.16

PHP PHP=5.6.17

PHP PHP=5.6.18

PHP PHP=5.6.19

PHP PHP=5.6.20

PHP PHP=5.6.21

PHP PHP=5.6.22

PHP PHP=5.6.23

PHP PHP=7.0.0

PHP PHP=7.0.1

PHP PHP=7.0.2

PHP PHP=7.0.3

PHP PHP=7.0.4

PHP PHP=7.0.5

PHP PHP=7.0.8

PHP PHP<7.0.9

7.0.9

Remediation

Patch Available

http://git.php.net/?p=php-src.git;a=commit;h=41131cd41d2fd2e0c2f332a27988df75659c42e4

Patch Available

http://openwall.com/lists/oss-security/2016/07/24/2

Event History

Jul 25, 2016

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2016-6292?

CVE-2016-6292 is considered a moderate severity vulnerability due to its potential to cause denial of service through a NULL pointer dereference.

How do I fix CVE-2016-6292?

To fix CVE-2016-6292, update PHP to versions 5.5.38, 5.6.24, or 7.0.9 or later.

What are the affected PHP versions for CVE-2016-6292?

CVE-2016-6292 affects PHP versions prior to 5.5.38, all versions of 5.6 before 5.6.24, and all versions before 7.0.9.

What type of attack does CVE-2016-6292 enable?

CVE-2016-6292 enables remote attackers to execute a denial of service attack, causing application crashes.

Is it safe to use PHP versions after the fixes for CVE-2016-6292?

Yes, PHP versions 5.5.38, 5.6.24, and 7.0.9 or later are considered safe from the vulnerabilities introduced by CVE-2016-6292.

CVE-2016-6292: Null Pointer Dereference

Other sources

Affected Software

Remediation

Patch Available

Patch Available

Event History

Frequently Asked Questions

What is the severity of CVE-2016-6292?

How do I fix CVE-2016-6292?

What are the affected PHP versions for CVE-2016-6292?

What type of attack does CVE-2016-6292 enable?

Is it safe to use PHP versions after the fixes for CVE-2016-6292?

Company

Resources

Contact