Denial of Service Vulnerability in PHP5 - CVE-2018-14851
Summary
ALPINE-CVE-2018-14851: exif_process_IFD_in_MAKERNOTE in ext/exif/exif.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8 allows remote attackers to cause a denial of service (out-of-bounds read and applica... Affects php5 versions < 5.6.37-r0. Fixed in 5.6.37-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP5 is a widely-used open-source scripting language designed for web development but also used as a general-purpose programming language. It is known for its ease of use, flexibility, and extensive community support. However, certain versions of PHP5 are vulnerable to a denial of service attack due to improper handling of crafted JPEG files, which can lead to application crashes.
Vulnerability Detail
The vulnerability, identified as CVE-2018-14851, exists in the exif_process_IFD_in_MAKERNOTE function within the ext/exif/exif.c file of PHP. This flaw affects PHP versions prior to 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8. Attackers can exploit this vulnerability by sending specially crafted JPEG files, resulting in out-of-bounds reads and potential application crashes, leading to denial of service.
How To Fix
Minimum fixed version
5.6.37-r0
This is the first release that contains the fix.
sudo apk add --upgrade php5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation to reject any JPEG files that do not meet expected criteria. This can help mitigate the risk of exploitation until the package is updated.
Conclusion
CVE-2018-14851 is a significant vulnerability in PHP that can lead to denial of service through crafted JPEG files. It is crucial for users to update their PHP installations to the latest patched versions to mitigate this risk. Regular monitoring and vulnerability assessment using tools like Vulert can help maintain application security.
See every vulnerability recorded for php5 →
FAQ
CVE-2018-14851 is a vulnerability in PHP that allows remote attackers to cause a denial of service via crafted JPEG files.
Affected versions include PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8.
Exploitation of this vulnerability can lead to application crashes, resulting in denial of service for users.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 5.5, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for php5.
