CVE-2018-10549: Buffer Overflow
An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. exifreaddata in ext/exif/exif.c has an out-of-bounds read for crafted JPEG data because exifiifaddvalue mishandles the case of a MakerNote that lacks a final '\0' character.
Other sources
An issue was discovered in PHP before from 5.6.25 to 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. exifreaddata in ext/exif/exif.c has an out-of-bounds read for crafted JPEG data because exifiifaddvalue mishandles the case of a MakerNote that lacks a final '\0' character.
Upstream bug:
https://bugs.php.net/bug.php?id=76130
Upstream patch:
https://git.php.net/?p=php-src.git;a=commit;h=b4e4788c4461449b4587e19ef1f474ce938e4980
— Red Hat
An out-of-bounds read has been found in PHP when function exifiifaddvalue handles the case of a MakerNote that lacks a final terminator character. A remote attacker could use this vulnerability to cause a crash.
Fixed bug (Heap Buffer Overflow (READ: 1786) in exifiifaddvalue). (CVE-2018-10549)
— PHP
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-10549?
CVE-2018-10549 has been assigned a medium severity rating due to its potential to cause out-of-bounds reads.
How do I fix CVE-2018-10549?
To fix CVE-2018-10549, upgrade PHP to version 5.6.36, 7.0.30, 7.1.17, or 7.2.5, as applicable.
What software versions are affected by CVE-2018-10549?
CVE-2018-10549 affects PHP versions prior to 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5.
Is CVE-2018-10549 specific to certain operating systems?
Yes, CVE-2018-10549 affects multiple operating systems, including various versions of Red Hat, Debian, and Ubuntu.
What is the attack vector for CVE-2018-10549?
The attack vector for CVE-2018-10549 involves crafted JPEG data that exploits the handling of MakerNote in the exif_read_data function.