CVE-2016-4544
CriticalSummary
The exif_process_TIFF_in_JPEG function in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate TIFF start data, allowing remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.
Risk Assessment
The lack of validation for TIFF data may lead to serious availability issues for applications, impacting the continuity of operations within the organization.
Recommendation
It is recommended to update PHP to the latest version to mitigate this vulnerability and to implement additional security measures against denial of service attacks.
Original NVD description (English source)
The exif_process_TIFF_in_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate TIFF start data, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.