Bug #76409 [Csd]: heap use after free in _php_stream_free
Edit report at https://bugs.php.net/bug.php?id=76409&edit=1
ID: 76409
Updated by: cmb@php.net
Reported by: geeknik at protonmail dot ch
Summary: heap use after free in _php_stream_free
Status: Closed
Type: Bug
Package: EXIF related
Operating System: Ubuntu 16 LTS
PHP Version: 7.2Git-2018-06-02 (Git)
-Assigned To: cmb
+Assigned To: stas
Block user comment: N
Private report: N
New Comment:
Requesting a CVE for a bug which had been reported and discussed
publicly is pretty strange.
Stas, would do you think?
Previous Comments:
------------------------------------------------------------------------
[2018-06-26 02:52:31] geeknik at protonmail dot ch
CVE-2018-12882 has been assigned to this bug.
------------------------------------------------------------------------
[2018-06-09 16:55:36] cmb@php.net
Indeed, PHP-7.2 as well as master have been affected (but not
earlier version branches), and both have been fixed.
------------------------------------------------------------------------
[2018-06-09 16:39:34] geeknik at protonmail dot ch
FYI, this affects the 7.2.6 release as well, but I haven't tested other versions.
------------------------------------------------------------------------
[2018-06-09 16:22:00] cmb@php.net
Automatic comment on behalf of cmbecker69@gmx.de
Revision: http://git.php.net/?p=php-src.git;a=commit;h=3fdde65617e9f954e2c964768aac8831005497e5
Log: Fix #76409: heap use after free in _php_stream_free
------------------------------------------------------------------------
[2018-06-03 12:08:56] cmb@php.net
The following patch has been added/updated:
Patch Name: avoid-double-free.patch
Revision: 1528027735
URL: https://bugs.php.net/patch-display.php?bug=76409&patch=avoid-double-free.patch&revision=1528027735
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=76409
--
Edit this bug report at https://bugs.php.net/bug.php?id=76409&edit=1
Thread (8 messages)