CVE-2018-12882: Use After Free
exifreadfromimpl in ext/exif/exif.c in PHP 7.2.x through 7.2.7 allows attackers to trigger a use-after-free (in exifreadfromfile) because it closes a stream that it is not responsible for closing. The vulnerable code is reachable through the PHP exifreaddata function.
Other sources
Fixed bug (heap use after free in phpstreamfree). (CVE-2018-12882)
— PHP
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-12882?
CVE-2018-12882 has been identified as a medium severity vulnerability due to the potential for a use-after-free condition that may lead to arbitrary code execution.
How do I fix CVE-2018-12882?
To fix CVE-2018-12882, upgrade to PHP version 7.2.8 or later.
What versions of PHP are affected by CVE-2018-12882?
CVE-2018-12882 affects PHP versions 7.2.0 through 7.2.7.
What is the nature of the vulnerability described in CVE-2018-12882?
CVE-2018-12882 is a use-after-free vulnerability in the exif_read_from_impl function within PHP's EXIF processing.
Is CVE-2018-12882 present in other PHP versions aside from 7.2?
CVE-2018-12882 specifically affects PHP version 7.2.x and does not affect older versions like PHP 5.x or PHP 7.0 and 7.1.