Executive brief
PHP is a widely used programming language for web development. A vulnerability in its image metadata processing component (EXIF) allows an attacker to crash a web server or application by providing a specially crafted image file. This results in a denial of service, potentially disrupting website availability and business operations.
Technical details
A floating point exception (FPE) exists in the exif_convert_any_to_int function within ext/exif/exif.c. The vulnerability is triggered when processing crafted EXIF data that causes an integer overflow/division error, specifically an attempt to divide the minimum representable negative integer by -1. This is reachable by remote, unauthenticated attackers who can submit images to be processed by the affected PHP versions. Successful exploitation results in an immediate crash of the PHP process (Denial of Service). The issue was addressed in PHP versions 5.6.30, 7.0.15, and 7.1.1.
Affected products
- PHP Group PHP before 5.6.30, 7.0.x before 7.0.15, 7.1.x before 7.1.1
Timeline
- 2017-01-19: patched: Fixed in PHP 5.6.30
- 2017-01-24: disclosed: NVD publication date