CVE-2018-12882

Summary

CVE	CVE-2018-12882
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2018-06-26 03:29:00 UTC
Updated	2019-03-12 11:46:00 UTC
Description	exif_read_from_impl in ext/exif/exif.c in PHP 7.2.x through 7.2.7 allows attackers to trigger a use-after-free (in exif_read_from_file) because it closes a stream that it is not responsible for closing. The vulnerable code is reachable through the PHP exif_read_data function.

Risk And Classification

Problem Types: CWE-416

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Canonical	Ubuntu Linux	18.04	All	All	All
Operating System	Canonical	Ubuntu Linux	18.04	All	All	All
Application	Netapp	Storage Automation Store	-	All	All	All
Application	Netapp	Storage Automation Store	-	All	All	All
Application	Php	Php	All	All	All	All

References

Reference	Source	Link	Tags
PHP :: Sec Bug #76409 :: heap use after free in _php_stream_free	CONFIRM	bugs.php.net	Issue Tracking, Patch, Vendor Advisory
USN-3702-1: PHP vulnerability \| Ubuntu security notices \| Ubuntu	UBUNTU	usn.ubuntu.com	Third Party Advisory
USN-3702-2: PHP vulnerability \| Ubuntu security notices \| Ubuntu	UBUNTU	usn.ubuntu.com	Third Party Advisory
PHP 'ext/exif/exif.c' Denial of Service Vulnerability	BID	www.securityfocus.com	Third Party Advisory, VDB Entry
CVE-2018-12882 PHP Vulnerability in NetApp Products \| NetApp Product Security	CONFIRM	security.netapp.com	Third Party Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

501132 Alpine Linux Security Update for php7
752878 SUSE Enterprise Linux Security Update for php7 (SUSE-SU-2022:4067-1)