blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2015-0232

MEDIUM 6.8 CVSS 2.0
Published
January 27, 2015
Last modified
June 17, 2026
NVD status
Modified
Reported by
secalert@redhat.com
CVSS vector
AV:N/AC:M/Au:N/C:P/I:P/A:P

Description

The exif_process_unicode function in ext/exif/exif.c in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized pointer free and application crash) via crafted EXIF data in a JPEG image.

Affected products and versions

  • PHP — Up to and including 5.4.36
  • PHP versions 5.4.0, 5.4.1, 5.4.2, 5.4.3, 5.4.4, 5.4.5, 5.4.6, 5.4.7, 5.4.8, 5.4.9, 5.4.10, 5.4.11, 5.4.12, 5.4.12rc1, 5.4.12rc2, 5.4.13, 5.4.13rc1, 5.4.14, 5.4.14rc1, 5.4.15rc1, 5.4.16rc1, 5.4.17, 5.4.18, 5.4.19, 5.4.20, 5.4.21, 5.4.22, 5.4.23, 5.4.24, 5.4.25, 5.4.26, 5.4.27, 5.4.28, 5.4.29, 5.4.30, 5.4.34, 5.4.35, 5.5.0, 5.5.0alpha1, 5.5.0alpha2, 5.5.0alpha3, 5.5.0alpha4, 5.5.0alpha5, 5.5.0alpha6, 5.5.0beta1, 5.5.0beta2, 5.5.0beta3, 5.5.0beta4, 5.5.0rc1, 5.5.0rc2, 5.5.1, 5.5.2, 5.5.3, 5.5.4, 5.5.5, 5.5.6, 5.5.7, 5.5.8, 5.5.9, 5.5.10, 5.5.11, 5.5.12, 5.5.13, 5.5.14, 5.5.15, 5.5.16, 5.5.17, 5.5.18, 5.5.19, 5.5.20, 5.6.0alpha1, 5.6.0alpha2, 5.6.0alpha3, 5.6.0alpha4, 5.6.0alpha5, 5.6.0beta1, 5.6.0beta2, 5.6.0beta3, 5.6.0beta4, 5.6.1, 5.6.2, 5.6.3, 5.6.4

References

  • advisories.mageia.org http://advisories.mageia.org/MGASA-2015-0040.html
  • git.php.net http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=21bc7464f454fec18a9ec024c738f195602fee2a
  • git.php.net http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=2fc178cf448d8e1b95d1314e47eeef610729e0df
  • git.php.net http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=55001de6d8c6ed2aada870a76de1e4b4558737bf
  • lists.apple.com http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html
  • lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00029.html
  • lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2015-02/msg00079.html
  • marc.info http://marc.info/?l=bugtraq&m=143748090628601&w=2
  • marc.info http://marc.info/?l=bugtraq&m=144050155601375&w=2
  • rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2015-1053.html
  • rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2015-1066.html
  • rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2015-1135.html
  • rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2015-1218.html
  • www.debian.org http://www.debian.org/security/2015/dsa-3195
  • www.mandriva.com http://www.mandriva.com/security/advisories?name=MDVSA-2015:032
  • www.oracle.com http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
  • www.oracle.com http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
  • www.php.net http://www.php.net/ChangeLog-5.php
  • www.securityfocus.com http://www.securityfocus.com/bid/72541
  • bugs.php.net https://bugs.php.net/bug.php?id=68799 Exploit, Patch, Vendor Advisory
  • bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=1185472 Patch
  • security.gentoo.org https://security.gentoo.org/glsa/201503-03
  • support.apple.com https://support.apple.com/HT205267
  • nvd.nist.gov Official NVD record