1. CVE-Search
  2. CVE-2018-12882
ID CVE-2018-12882
Summary exif_read_from_impl in ext/exif/exif.c in PHP 7.2.x through 7.2.7 allows attackers to trigger a use-after-free (in exif_read_from_file) because it closes a stream that it is not responsible for closing. The vulnerable code is reachable through the PHP exif_read_data function.
References
Vulnerable Configurations
  • cpe:2.3:a:php:php:7.2.0:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.2.0:-:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.2.0:-:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.2.0:alpha1:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.2.0:alpha1:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.2.0:alpha2:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.2.0:alpha2:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.2.0:alpha3:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.2.0:alpha3:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.2.0:beta1:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.2.0:beta1:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.2.0:beta2:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.2.0:beta2:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.2.0:beta3:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.2.0:beta3:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.2.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.2.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.2.0:rc2:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.2.0:rc2:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.2.0:rc3:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.2.0:rc3:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.2.0:rc4:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.2.0:rc4:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.2.0:rc5:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.2.0:rc5:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.2.0:rc6:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.2.0:rc6:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.2.1:-:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.2.1:-:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.2.1:rc1:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.2.1:rc1:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.2.2:*:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.2.2:-:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.2.2:-:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.2.2:rc1:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.2.2:rc1:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.2.3:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.2.3:*:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.2.3:-:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.2.3:-:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.2.3:rc1:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.2.3:rc1:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.2.4:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.2.4:*:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.2.4:-:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.2.4:-:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.2.4:rc1:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.2.4:rc1:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.2.5:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.2.5:*:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.2.5:-:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.2.5:-:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.2.5:rc1:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.2.5:rc1:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.2.6:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.2.6:*:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.2.6:-:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.2.6:-:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.2.6:rc1:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.2.6:rc1:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.2.7:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.2.7:*:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.2.7:-:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.2.7:-:*:*:*:*:*:*
  • cpe:2.3:a:php:php:7.2.7:rc1:*:*:*:*:*:*
    cpe:2.3:a:php:php:7.2.7:rc1:*:*:*:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
    cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
  • cpe:2.3:a:netapp:storage_automation_store:-:*:*:*:*:*:*:*
    cpe:2.3:a:netapp:storage_automation_store:-:*:*:*:*:*:*:*
CVSS
Base: 7.5 (as of 12-03-2019 - 11:46)
Impact:
Exploitability:
CWE CWE-416
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:P
refmap via4
bid 104551
confirm
ubuntu
  • USN-3702-1
  • USN-3702-2
Last major update 12-03-2019 - 11:46
Published 26-06-2018 - 03:29
Last modified 12-03-2019 - 11:46
Back to Top