PT-2009-5082 · Php+2 · Php+2

Pierre · Published 2009-08-05 · Updated 2023-01-19 · CVE-2009-2687

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.2.10

Description The issue is related to the exif read data function in the Exif module, which allows remote attackers to cause a denial of service (crash) by providing a malformed JPEG image with invalid offset fields.

Recommendations For versions prior to 5.2.10, update to version 5.2.10 or later to resolve the issue. As a temporary workaround, consider disabling the exif read data function until a patch is available. Restrict access to the Exif module to minimize the risk of exploitation.

Exploit

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2009-2687

DSA-1940-1

HPSBUX02543

RHSA-2009:1461

RHSA-2010:0040

RHSA-2010_0040

Affected Products

Hp-Ux

Php

Red Hat

References · 54

• 🔥 http://bugs.php.net/bug.php?id=48378 · Exploit
• http://php.net/releases/5_2_10.php · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07212 · Security Note
• http://marc.info/?l=bugtraq&m=127680701405735&w=2 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07207 · Security Note
• http://debian.org/security/2009/dsa-1940 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-08544 · Security Note
• https://bdu.fstec.ru/vul/2015-08548 · Security Note
• https://bdu.fstec.ru/vul/2015-08543 · Security Note
• https://bdu.fstec.ru/vul/2015-08547 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4143 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3293 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2009:167 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07210 · Security Note
• https://bdu.fstec.ru/vul/2015-07213 · Security Note