CVE-2016-7128

The exif_process_IFD_in_TIFF function in ext/exif/exif.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles the case of a thumbnail offset that exceeds the…

published September 12, 2016

CVSS
—
EPSS
8%
Percentile
94.6
In the wild
Unconfirmed
What it is

The exif_process_IFD_in_TIFF function in ext/exif/exif.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles the case of a thumbnail offset that exceeds the file size, which allows remote attackers to obtain sensitive information from process memory via a crafted TIFF image.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.07767 · 94.6th percentile
Published
2016-09-12T01:00Z
EPSS history
Timeline
  • 12 SEP 01:00Z
    The exif_process_IFD_in_TIFF function in ext/exif/exif.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles the case of a thumbnail offset that exceeds the…
    cvelistv5