CVE-2011-4566: Canonical Ubuntu Linux

Medium severity, CVSS 6.4. EPSS: 6.6% chance of exploitation in the next 30 days.

Integer overflow in the exif_process_IFD_TAG function in exif.c in the exif extension in PHP 5.4.0beta2 on 32-bit platforms allows remote attackers to read the contents of arbitrary memory locations or cause a denial of service via a crafted offset_val value in an EXIF header in a JPEG file, a different vulnerability than CVE-2011-0708.

Affected products

• Canonical Ubuntu Linux: version 8.04 only; version 10.04 only; version 10.10 only; version 11.04 only; version 11.10 only
• Debian Debian Linux: version 5.0 only; version 6.0 only; version 7.0 only
• PHP PHP: from 5.3.0, before 5.3.9 (fixed in 5.3.9); version 5.4.0 only

Published 2011-11-29. Last modified 2026-06-16.