PulseLinuxLINUX UPDATE INTELLIGENCE
CVE Database›CVE-2018-12882

CVE-2018-12882

php: Use-after-free reachable via the exif.c:exif_read_from_impl() function

Loading…

Severity

Moderate

Red Hat Product Security

6.3

CVSS 3.0

Review impact separately from score.

Published · June 3, 2018

Updated · November 22, 2025

Description

exif_read_from_impl in ext/exif/exif.c in PHP 7.2.x through 7.2.7 allows attackers to trigger a use-after-free (in exif_read_from_file) because it closes a stream that it is not responsible for closing. The vulnerable code is reachable through the PHP exif_read_data function.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.0 · 6.3
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

CWE-416 · Use After Free