CVE-2018-12882 : exif_read_from_impl in ext/exif/exif.c in PHP 7.2.x through 7.2.7 allows attacke

exif_read_from_impl in ext/exif/exif.c in PHP 7.2.x through 7.2.7 allows attackers to trigger a use-after-free (in exif_read_from_file) because it closes a stream that it is not responsible for closing. The vulnerable code is reachable through the PHP exif_read_data function.

Published 2018-06-26 03:29:00

Updated 2019-03-12 11:46:21

Source MITRE

View at NVD, CVE.org

Vulnerability category: Memory Corruption

Products affected by CVE-2018-12882

PHP » PHP
Versions from including (>=) 7.2.0 and up to, including, (<=) 7.2.7
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 18.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
Matching versions
Netapp » Storage Automation Store » Version: N/A
cpe:2.3:a:netapp:storage_automation_store:-:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2018-12882

Top countries where our scanners detected CVE-2018-12882

Top open port discovered on systems with this issue 80

IPs affected by CVE-2018-12882 17,194

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2018-12882!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2018-12882

EPSS FAQ

0.69%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 80 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-12882

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
9.8	CRITICAL	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2018-12882

CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2018-12882

https://usn.ubuntu.com/3702-2/

USN-3702-2: PHP vulnerability | Ubuntu security notices
Third Party Advisory
https://bugs.php.net/bug.php?id=76409

PHP :: Sec Bug #76409 :: heap use after free in _php_stream_free
Issue Tracking;Patch;Vendor Advisory
http://www.securityfocus.com/bid/104551

PHP 'ext/exif/exif.c' Denial of Service Vulnerability
Third Party Advisory;VDB Entry
https://security.netapp.com/advisory/ntap-20181109-0001/

CVE-2018-12882 PHP Vulnerability in NetApp Products | NetApp Product Security
Third Party Advisory
https://usn.ubuntu.com/3702-1/

USN-3702-1: PHP vulnerability | Ubuntu security notices
Third Party Advisory