CVE-2015-0232

Public Exploit

Description

The exif_process_unicode function in ext/exif/exif.c in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized pointer free and application crash) via crafted EXIF data in a JPEG image.

6.8

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 65.29% Top 5%

Vendor Advisory mandriva.com Vendor Advisory debian.org Vendor Advisory marc.info Vendor Advisory opensuse.org Vendor Advisory apple.com Vendor Advisory marc.info Vendor Advisory opensuse.org Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory gentoo.org Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory php.net

Affected: n/a n/a

References

Link	Tags
http://www.mandriva.com/security/advisories?name=MDVSA-2015:032	vendor advisory
http://www.debian.org/security/2015/dsa-3195	vendor advisory
http://www.securityfocus.com/bid/72541	vdb entry
http://marc.info/?l=bugtraq&m=144050155601375&w=2	vendor advisory
http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00029.html	vendor advisory
http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=2fc178cf448d8e1b95d1314e47eeef610729e0df
http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html	vendor advisory
http://marc.info/?l=bugtraq&m=143748090628601&w=2	vendor advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=21bc7464f454fec18a9ec024c738f195602fee2a
http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
https://bugs.php.net/bug.php?id=68799	exploit patch vendor advisory
http://lists.opensuse.org/opensuse-updates/2015-02/msg00079.html	vendor advisory
https://support.apple.com/HT205267
http://www.php.net/ChangeLog-5.php
http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=55001de6d8c6ed2aada870a76de1e4b4558737bf
https://bugzilla.redhat.com/show_bug.cgi?id=1185472	patch
http://rhn.redhat.com/errata/RHSA-2015-1135.html	vendor advisory
http://rhn.redhat.com/errata/RHSA-2015-1053.html	vendor advisory
https://security.gentoo.org/glsa/201503-03	vendor advisory
http://advisories.mageia.org/MGASA-2015-0040.html
http://rhn.redhat.com/errata/RHSA-2015-1066.html	vendor advisory
http://rhn.redhat.com/errata/RHSA-2015-1218.html	vendor advisory

Frequently Asked Questions

What is the severity of CVE-2015-0232?: CVE-2015-0232 has been scored as a medium severity vulnerability.
How to fix CVE-2015-0232?: To fix CVE-2015-0232, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2015-0232 being actively exploited in the wild?: It is possible that CVE-2015-0232 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~65% probability that this vulnerability will be exploited by malicious actors in the next 30 days.