CVE-2018-14851: Buffer Overflow
exifprocessIFDinMAKERNOTE in ext/exif/exif.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG file.
Other sources
Fixed bug (heap-buffer-overflow (READ of size 48) while reading exif data). (CVE-2018-14851)
— PHP
PHP before versions 5.6.37, 7.0.31, 7.1.20 and 7.2.8 is vulnerable to a heap-based buffer overflow in the exif.c:exifprocessIFDinMAKERNOTE() function. An attacker could exploit this to cause a denial of service via crafted file.
Upstream Bug:
https://bugs.php.net/bug.php?id=76557
Upstream Patch:
http://git.php.net/?p=php-src.git;a=commit;h=3462efa386f26d343062094514af604c29e3edce
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rh-php71-phpto a version that resolves this vulnerability.Fixed in 0:7.1.30-1.el7 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 5.6.37 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.0.31 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.1.20 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.2.8 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 7.0.31 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.6.37 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.0.31 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.1.20 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.2.8 - Compensating control
Mitigate denial-of-service risk by restricting or filtering uploads/processing of crafted JPEG files that reach the PHP exif processing code (ext/exif/exif.c, exif_process_IFD_in_MAKERNOTE), until the affected PHP versions are patched.
Event History
Frequently Asked Questions
What is the vulnerability ID for this bug?
The vulnerability ID for this bug is CVE-2018-14851.
What is the severity of CVE-2018-14851?
The severity of CVE-2018-14851 is medium with a severity value of 5.9.
Which software versions are affected by CVE-2018-14851?
PHP versions before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8 are affected by CVE-2018-14851.
How can a remote attacker exploit CVE-2018-14851?
A remote attacker can exploit CVE-2018-14851 by sending a crafted JPEG file, which can cause a denial of service by triggering an out-of-bounds read and application crash.
Where can I find more information about CVE-2018-14851?
You can find more information about CVE-2018-14851 at the following references: [1] [2] [3]