Integer Overflow Vulnerability in PHP5 - CVE-2018-14883
Summary
ALPINE-CVE-2018-14883: An issue was discovered in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8. Affects php5 versions < 5.6.37-r0. Fixed in 5.6.37-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP5 is a widely-used open-source scripting language designed for web development but also used as a general-purpose programming language. It is known for its ease of use, flexibility, and extensive community support. However, certain versions of PHP5, along with other PHP versions, are vulnerable to an integer overflow issue that can lead to serious security risks.
Vulnerability Detail
An integer overflow vulnerability was discovered in PHP versions prior to 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8. This vulnerability occurs in the 'exif_thumbnail_extract' function within 'exif.c', which can lead to a heap-based buffer over-read. This could potentially allow an attacker to exploit the vulnerability to execute arbitrary code, leading to a compromise of the affected system.
How To Fix
Minimum fixed version
5.6.37-r0
This is the first release that contains the fix.
sudo apk add --upgrade php5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the EXIF extension in PHP if it is not needed for your application. This can be done by modifying the php.ini file and commenting out the line that loads the EXIF extension.
Conclusion
The integer overflow vulnerability in PHP5, identified as CVE-2018-14883, poses significant risks to applications using affected versions. It is crucial to update to the patched versions to mitigate potential security threats.
See every vulnerability recorded for php5 →
FAQ
CVE-2018-14883 is a vulnerability identifier for an integer overflow issue in PHP that can lead to a heap-based buffer over-read.
Affected versions include PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8.
The vulnerability can lead to arbitrary code execution, allowing attackers to compromise the affected system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for php5.
