CVE-2009-3292
HIGH
7.5
CVSS 2.0
Description
Unspecified vulnerability in PHP before 5.2.11, and 5.3.x before 5.3.1, has unknown impact and attack vectors related to "missing sanity checks around exif processing."
Affected products and versions
- PHP — Up to and including 5.2.10
- PHP versions 1.0, 2.0, 2.0b10, 3.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.0.10, 3.0.11, 3.0.12, 3.0.13, 3.0.14, 3.0.15, 3.0.16, 3.0.17, 3.0.18, 4, 4.0, 4.0.0, 4.0.1, 4.0.1patch1, 4.0.1patch2, 4.0.2, 4.0.3, 4.0.3patch1, 4.0.4, 4.0.4patch1, 4.0.5, 4.0.6, 4.0.7, 4.0.7rc1, 4.0.7rc2, 4.0.7rc3, 4.0.7rc4, 4.0beta1, 4.0beta2, 4.0beta3, 4.0beta4, 4.0beta_4_patch1, 4.0rc1, 4.0rc2, 4.1.0, 4.1.1, 4.1.2, 4.2, 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.3.0, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 4.3.8, 4.3.9, 4.3.10, 4.3.11, 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5, 4.4.6, 4.4.7, 4.4.8, 4.4.9, 5, 5.0.0, 5.0.0beta1, 5.0.0beta2, 5.0.0beta3, 5.0.0beta4, 5.0.0rc1, 5.0.0rc2, 5.0.0rc3, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0rc1, 5.0rc2, 5.0rc3, 5.1.0, 5.1.1, 5.1.2, 5.1.3, 5.1.4, 5.1.5, 5.1.6, 5.2.0, 5.2.2, 5.2.4, 5.2.6, 5.2.7, 5.2.8, 5.2.9
References
- lists.apple.com http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html
- lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html
- marc.info http://marc.info/?l=bugtraq&m=127680701405735&w=2
- marc.info http://marc.info/?l=bugtraq&m=130497311408250&w=2
- news.php.net http://news.php.net/php.announce/79
- secunia.com http://secunia.com/advisories/36791 Vendor Advisory
- secunia.com http://secunia.com/advisories/37412 Vendor Advisory
- secunia.com http://secunia.com/advisories/37482 Vendor Advisory
- secunia.com http://secunia.com/advisories/40262 Vendor Advisory
- support.apple.com http://support.apple.com/kb/HT3937
- www.debian.org http://www.debian.org/security/2009/dsa-1940
- www.mandriva.com http://www.mandriva.com/security/advisories?name=MDVSA-2009:302
- www.openwall.com http://www.openwall.com/lists/oss-security/2009/11/20/2
- www.openwall.com http://www.openwall.com/lists/oss-security/2009/11/20/3
- www.osvdb.org http://www.osvdb.org/58186
- www.php.net http://www.php.net/ChangeLog-5.php
- www.php.net http://www.php.net/ChangeLog-5.php#5.2.11 Vendor Advisory
- www.php.net http://www.php.net/releases/5_2_11.php
- www.php.net http://www.php.net/releases/5_3_1.php
- www.securitytracker.com http://www.securitytracker.com/id?1022914
- www.vupen.com http://www.vupen.com/english/advisories/2009/3184 Vendor Advisory
- oval.cisecurity.org https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7652
- oval.cisecurity.org https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9982
- nvd.nist.gov Official NVD record