Intrusion Prevention



This indicates an attack attempt to exploit a Denial of Service vulnerability in PHP.
The vulnerability is due to a null pointer dereference in exif_process_user_comment when the vulnerable software tries to handle JIS encoded user comment Exif tags while multi-byte string support is enabled in PHP. A remote attacker may be able exploit this to perform a denial of service condition on the system via a crafted image.

Affected Products

PHP Group PHP prior to 5.5.38
PHP Group PHP prior to 5.6.24
PHP Group PHP prior to 7.0.9


Denial of Service: Remote attackers can crash vulnerable systems

Recommended Actions

Apply the most recent upgrade or patch from the vendor.

CVE References