Think you have a false positive on this rule?

Sid 1-40297

Message

FILE-IMAGE PHP exifprocessIFDinMAKERNOTE out of bounds read attempt

Summary

The exifprocessIFDinMAKERNOTE function in ext/exif/exif.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (out-of-bounds array access and memory corruption), obtain sensitive information from process memory, or possibly have unspecified other impact via a crafted JPEG image.

Impact

CVSS base score 9.8 CVSS impact score 5.9 CVSS exploitability score 3.9 confidentialityImpact HIGH integrityImpact HIGH availabilityImpact HIGH

CVE-2016-6291:

CVSS base score 9.8

CVSS impact score 5.9

CVSS exploitability score 3.9

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Detailed information

CVE-2016-6291: The exifprocessIFDinMAKERNOTE function in ext/exif/exif.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (out-of-bounds array access and memory corruption), obtain sensitive information from process memory, or possibly have unspecified other impact via a crafted JPEG image.

Affected systems

  • php php 5.5.37
  • php php 5.6.0
  • php php 5.6.1
  • php php 5.6.2
  • php php 5.6.3
  • php php 5.6.4
  • php php 5.6.5
  • php php 5.6.6
  • php php 5.6.7
  • php php 5.6.8
  • php php 5.6.9
  • php php 5.6.10
  • php php 5.6.11
  • php php 5.6.12
  • php php 5.6.13
  • php php 5.6.14
  • php php 5.6.15
  • php php 5.6.16
  • php php 5.6.17
  • php php 5.6.18
  • php php 5.6.19
  • php php 5.6.20
  • php php 5.6.21
  • php php 5.6.22
  • php php 5.6.23
  • php php 7.0.0
  • php php 7.0.1
  • php php 7.0.2
  • php php 7.0.3
  • php php 7.0.4
  • php php 7.0.5
  • php php 7.0.8

Ease of attack

CVE-2016-6291:

Access Vector

Access Complexity

Authentication

False positives

None known

False negatives

None known

Corrective action

Upgrade to the latest non-affected version of the software.

Apply the appropriate vendor supplied patches.

Contributors

  • Talos research team.
  • This document was generated from data supplied by the national vulnerability database, a product of the national institute of standards and technology.
  • For more information see nvd.

Additional References

  • bugs.php.net/bug.php?id=72603