Description
Unspecified vulnerability in PHP before 5.2.11, and 5.3.x before 5.3.1, has unknown impact and attack vectors related to "missing sanity checks around exif processing."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | php5 | 5.2.6.dfsg.1-1+lenny4 | DSA-1940-1 |
| Debian 4.0 | php5 | 5.2.0+dfsg-8+etch16 | DSA-1940-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | php +18 | 5.1.6-24.el5_4.5 | RHSA-2010:0040 |
| RHEL 4 | php +13 | 4.3.9-3.29 | RHSA-2010:0040 |
| RHEL 3 | php +6 | 4.3.2-54.ent | RHSA-2010:0040 |
Advisories 2
- RHSA-2010:0040 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1940-1 php5 - multiple issues Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://www.php.net/ChangeLog-5.php#5.2.11
- [oss-security] 20091120 Re: CVE request: php 5.3.1 update mailing-list
- 37482 third-party-advisory
- 40262 third-party-advisory
- [php-announce] 20091119 5.3.1 Release announcement mailing-list
- HPSBUX02543 vendor-advisory
- SSRT090208 vendor-advisory
- http://www.php.net/releases/5_2_11.php
- 1022914 vdb-entry
- 58186 vdb-entry
- oval:org.mitre.oval:def:9982 vdb-entry signature
- 36791 third-party-advisory
- DSA-1940 vendor-advisory
- http://www.php.net/ChangeLog-5.php
- [oss-security] 20091120 CVE request: php 5.3.1 update mailing-list
- http://www.php.net/releases/5_3_1.php
- 37412 third-party-advisory
- MDVSA-2009:302 vendor-advisory
- ADV-2009-3184 vdb-entry
- APPLE-SA-2009-11-09-1 vendor-advisory
- SUSE-SR:2009:017 vendor-advisory
- http://support.apple.com/kb/HT3937
- oval:org.mitre.oval:def:7652 vdb-entry signature