CVE-2018-12882
Fixed in a distro release EPSS 7%
exif_read_from_impl in ext/exif/exif.c in PHP 7.2.x through 7.2.7 allows attackers to trigger a use-after-free (in exif_read_from_file) because it closes a stream that it is not responsible for closing. The vulnerable code is reachable through the PHP exif_read_data function.
Products: php, canonical ubuntu_linux, netapp storage_automation_store
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| SUSE Enterprise Storage 6 | php7 | 7.2.34-150000.4.103.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS | php7 | 7.2.34-150000.4.103.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS | php7 | 7.2.34-150000.4.103.1 |
| SUSE Linux Enterprise High Performance Computing 15-ESPOS | php7 | 7.2.34-150000.4.103.1 |
| SUSE Linux Enterprise High Performance Computing 15-LTSS | php7 | 7.2.34-150000.4.103.1 |
| SUSE Linux Enterprise Module for Web and Scripting 12 | php5 | 5.5.14-109.38.1 |
| SUSE Linux Enterprise Module for Web and Scripting 12 | php7 | 7.0.7-50.41.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 | php7 | 7.2.5-4.3.1 |
| SUSE Linux Enterprise Server 11 SP4 | php53 | 5.3.17-112.28.1 |
| SUSE Linux Enterprise Server 15 SP1-BCL | php7 | 7.2.34-150000.4.103.1 |
| SUSE Linux Enterprise Server 15 SP1-LTSS | php7 | 7.2.34-150000.4.103.1 |
| SUSE Linux Enterprise Server 15-LTSS | php7 | 7.2.34-150000.4.103.1 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | php53 | 5.3.17-112.28.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 | php7 | 7.2.34-150000.4.103.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP1 | php7 | 7.2.34-150000.4.103.1 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | php53 | 5.3.17-112.28.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | php5 | 5.5.14-109.38.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | php7 | 7.0.7-50.41.1 |
| Ubuntu 18.04 LTS | php7.2 | 7.2.7-0ubuntu0.18.04.2 |
| Ubuntu 18.04 LTS | php7.2 | 7.2.7-0ubuntu0.18.04.1 |
| openSUSE Leap 15.4 | php7 | 7.2.34-150000.4.103.1 |
| openSUSE Tumbleweed | php7 | 7.4.24-1.1 |
| openSUSE Tumbleweed | php8 | 8.0.11-1.1 |