CVE-2016-4542
CriticalSummary
The exif_process_IFD_TAG function in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not properly construct spprintf arguments, allowing remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.
Risk Assessment
This vulnerability may lead to denial of service, affecting application availability and potentially creating other unspecified threats to the system.
Recommendation
It is recommended to update PHP to the latest version to mitigate this vulnerability and to monitor the system for unauthorized access attempts.
Original NVD description (English source)
The exif_process_IFD_TAG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not properly construct spprintf arguments, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.