OSVDB ID: 15183 Title: PHP getimagesize() php_handle_iff() Function DoS |
Info |
|
|
Dates |
||||
|
|
Description |
PHP contains a flaw that may allow a remote attacker to cause a denial of service. The issue is due to the php_handle_iff function in image.c, as reachable by the getimagesize PHP function, not properly sanitizing user-supplied input. By passing a malformed value to this function, an attacker can cause an infinite loop and exhaust all system resources. |
Classification |
Location:
Remote / Network Access
Attack Type: Denial of Service, Input Manipulation Impact: Loss of Availability Exploit: Exploit Rumored Disclosure: OSVDB Verified, Vendor Verified |
Solution |
Upgrade to version 4.3.11, 5.0.4 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds. |
Products |
|
Credit |
|