CVE-2016-6291
CriticalSummary
The exif_process_IFD_in_MAKERNOTE function in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service via out-of-bounds array access and memory corruption. Attackers may also obtain sensitive information from process memory or possibly have unspecified other impact via a crafted JPEG image.
Risk Assessment
Organizations may be exposed to attacks leading to denial of service and disclosure of sensitive data, which can result in serious security and privacy implications.
Recommendation
It is recommended to update PHP to the latest version to mitigate this vulnerability and to monitor systems for suspicious activity related to JPEG image processing.
Original NVD description (English source)
The exif_process_IFD_in_MAKERNOTE function in ext/exif/exif.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (out-of-bounds array access and memory corruption), obtain sensitive information from process memory, or possibly have unspecified other impact via a crafted JPEG image.