Description
exif.c in the Exif extension in PHP before 5.3.6 on 64-bit platforms performs an incorrect cast, which allows remote attackers to cause a denial of service (application crash) via an image with a crafted Image File Directory (IFD) that triggers a buffer over-read.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | php5 | 5.3.3-7+squeeze3 | DSA-2266-1 |
| Debian 5.0 | php5 | 5.2.6.dfsg.1-1+lenny12 | DSA-2266-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | php +25 | 5.3.3-3.el6_1.3 | RHSA-2011:1423 |
| RHEL 5 | php +18 | 5.1.6-27.el5_7.4 | RHSA-2012:0033 |
| RHEL 5 | php53 +20 | 5.3.3-1.el5_7.3 | RHSA-2011:1423 |
| RHEL 4 | php +13 | 4.3.9-3.35 | RHSA-2012:0071 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | php5 | 5.6.28-1.1 | openSUSE-SU-2024:10344-1 |
| openSUSE Tumbleweed | php7 | 7.0.14-1.4 | openSUSE-SU-2024:10290-1 |
| openSUSE Tumbleweed | php8 | 8.0.11-1.1 | openSUSE-SU-2024:11169-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- PHP 'Exif' Extension - 'exif_read_data()' Remote Denial of Service EDB-16261 · dos · Feb 28, 2011 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 7
- RHSA-2011:1423 Red Hat Security Advisory: php53 and php security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2012:0071 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2012:0033 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2266-1 php5 - several Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10290-1 apache2-mod_php7-7.0.14-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10344-1 apache2-mod_php5-5.6.28-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11169-1 php8-8.0.11-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- HPSBOV02763 vendor-advisory
- FEDORA-2011-3636 vendor-advisory
- ADV-2011-0764 vdb-entry
- FEDORA-2011-3614 vendor-advisory
- 16261 exploit
- https://bugzilla.redhat.com/show_bug.cgi?id=680972
- MDVSA-2011:053 vendor-advisory
- DSA-2266 vendor-advisory
- ADV-2011-0890 vdb-entry
- http://www.php.net/releases/5_3_6.php
- http://www.php.net/ChangeLog-5.php
- http://www.php.net/archive/2011.php
- APPLE-SA-2011-10-12-3 vendor-advisory
- http://bugs.php.net/bug.php?id=54002
- [oss-security] 20110216 Re: Re: PHP Exif 64bit Casting Vulnerability, CVE request mailing-list
- RHSA-2011:1423 vendor-advisory
- [oss-security] 20110214 PHP Exif 64bit Casting Vulnerability, CVE request mailing-list
- FEDORA-2011-3666 vendor-advisory
- MDVSA-2011:052 vendor-advisory
- 8114 third-party-advisory
- 46365 vdb-entry
- ADV-2011-0744 vdb-entry
- RHSA-2012:0071 vendor-advisory
- http://support.apple.com/kb/HT5002
- http://svn.php.net/viewvc?view=revision&revision=308316