Podatność CVE-2005-1043


Publikacja: 2005-04-14   Modyfikacja: 2012-02-12

Opis:
exif.c in PHP before 4.3.11 allows remote attackers to cause a denial of service (memory consumption and crash) via an EXIF header with a large IFD nesting level, which causes significant stack recursion.

Typ:

CWE-Other

Producent: Peachtree
Produkt: Peachtree linux 
Wersje: release_1;
Producent: SUSE
Produkt: Suse linux 
Wersje:
9.3
9.2
9.1
9.0
8.2
8.1
8.0
7.3
7.2
7.1
7.0
6.4
6.3
6.2
6.1
6.0
5.3
5.2
5.1
5.0
4.4.1
4.4
4.3
4.2
4.0
3.0
2.0
1.0
Producent: Conectiva
Produkt: Linux 
Wersje: 9.0; 10.0;
Producent: PHP
Produkt: PHP 
Wersje:
4.3.9
4.3.8
4.3.7
4.3.6
4.3.5
4.3.4
4.3.3
4.3.2
4.3.10
4.3.1
4.3.0
4.3
Producent: SGI
Produkt: Propack 
Wersje: 3.0;
Producent: Apple
Produkt: Mac os x server 
Wersje:
10.4.1
10.4
10.3.9
Produkt: Mac os x 
Wersje:
10.4.1
10.4
10.3.9

CVSS2 => (AV:N/AC:L/Au:N/C:N/I:N/A:P)

Ogólna skala CVSS
Znaczenie
Łatwość wykorzystania
5/10
2.9/10
10/10
Wymagany dostęp
Złożoność ataku
Autoryzacja
Zdalny
Niska
Nie wymagana
Wpływ na poufność
Wpływ na integralność
Wpływ na dostępność
Brak
Brak
Częściowy

 Referencje:
http://cvs.php.net/diff.php/php-src/ext/exif/exif.c?r1=1.118.2.29&r2=1.118.2.30&ty=u
http://lists.apple.com/archives/security-announce/2005/Jun/msg00000.html
http://www.gentoo.org/security/en/glsa/glsa-200504-15.xml
http://www.mandriva.com/security/advisories?name=MDKSA-2005:072
http://www.redhat.com/support/errata/RHSA-2005-406.html
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=154025
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10307
https://usn.ubuntu.com/112-1/

Podobne CVE
CVE-2019-9536
Apple iPhone 3GS bootrom malloc implementation returns a non-NULL pointer when unable to allocate memory, aka 'alloc8'. An attacker with physical access to the device can install arbitrary firmware.
CVE-2019-9506
The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length negotiation. This allows practical brute-force attacks (aka "KNOB") tha...
CVE-2019-9518
Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONT...
CVE-2019-9517
Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so...
CVE-2019-9516
Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater h...
CVE-2019-9515
Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS f...
CVE-2019-9514
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the p...
CVE-2019-9513
Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the...

Copyright 2019, cxsecurity.com

 

Back to Top