CVE-2016-4543
CriticalSummary
The exif_process_IFD_in_JPEG function in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate IFD sizes, allowing remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.
Risk Assessment
The lack of IFD size validation may lead to serious availability issues, impacting the continuity of operations within the organization.
Recommendation
It is recommended to update PHP to the latest version to mitigate this vulnerability and to implement additional monitoring and security measures.
Original NVD description (English source)
The exif_process_IFD_in_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate IFD sizes, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.