Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

CVE-2014-3670

Published: 29 October 2014

The exif_ifd_make_value function in exif.c in the EXIF extension in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 operates on floating-point arrays incorrectly, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via a crafted JPEG image with TIFF thumbnail data that is improperly handled by the exif_thumbnail function.

Priority

Medium

Status

Package Release Status
php5
Launchpad, Ubuntu, Debian
upstream
Released (5.4.34, 5.5.18, 5.6.1)
lucid
Released (5.3.2-1ubuntu4.28)
precise
Released (5.3.10-1ubuntu3.15)
trusty
Released (5.5.9+dfsg-1ubuntu4.5)
utopic
Released (5.5.12+dfsg-2ubuntu4.1)
Patches:
upstream: http://git.php.net/?p=php-src.git;a=commit;h=ddb207e7fa2e9adeba021a1303c3781efda5409b (5.5)
upstream: http://git.php.net/?p=php-src.git;a=commit;h=287c91c1f060dc85a8bdb51488c50db8614448b7 (5.4)