It was found that malformed input to function exif_read_data() can cause out-of-bounds heap memory read access. Upstream bug: https://bugs.php.net/bug.php?id=72094 Upstream patch: https://git.php.net/?p=php-src.git;a=commit;h=1366c0362f1fa85e82bde9c0b393bd3bb3d32892
Created php tracking bugs for this issue: Affects: fedora-all [bug 1332882]
As per CVE assignment: http://seclists.org/oss-sec/2016/q2/259 Use CVE-2016-4542 for the issue associated with the spprintf call. Use CVE-2016-4543 for both issues in which "Illegal IFD size" validation was added. Use CVE-2016-4544 for the issue in which "Invalid TIFF start" validation was added.
php-5.6.21-1.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.
php-5.6.21-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
There are limited buffer over-reads, which may possibly cause crash or information leak. However, practically triggering either is of low probability because of how over-reads are limited. Hence no plan to backport this fix.
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS Via RHSA-2016:2750 https://rhn.redhat.com/errata/RHSA-2016-2750.html