CVE-2009-2687

Priority
Medium
Description
The exif_read_data function in the Exif module in PHP before 5.2.10 allows
remote attackers to cause a denial of service (crash) via a malformed JPEG
image with invalid offset fields, a different issue than CVE-2005-3353.
References
Bugs
Notes
mdeslaur> PoC in php bug
Package
Source: php4 (LP Ubuntu Debian)
Upstream:needs-triage
Ubuntu 8.04 LTS (Hardy Heron):DNE
Ubuntu 10.04 LTS (Lucid Lynx):DNE
Package
Source: php5 (LP Ubuntu Debian)
Upstream:released (5.2.10.dfsg.1-1)
Ubuntu 8.04 LTS (Hardy Heron):released (5.2.4-2ubuntu5.7)
Ubuntu 10.04 LTS (Lucid Lynx):not-affected (5.2.10.dfsg.1-2ubuntu1)
Patches:
Upstream:http://svn.php.net/viewvc?view=revision&revision=281307
Upstream:http://svn.php.net/viewvc?view=revision&revision=281314 (5.2)
Vendor:http://git.debian.org/?p=pkg-php/php.git;a=commitdiff;h=8615d344b20548e27ffbddd78e303af8c9a90859
More Information

Valid XHTML 1.0 Strict

Updated: 2012-06-01 15:20:01 UTC (commit 5347)