CVE-2018-12882

Name	CVE-2018-12882
Description	exif_read_from_impl in ext/exif/exif.c in PHP 7.2.x through 7.2.7 allows attackers to trigger a use-after-free (in exif_read_from_file) because it closes a stream that it is not responsible for closing. The vulnerable code is reachable through the PHP exif_read_data function.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
php5	source	(unstable)	(not affected)
php7.0	source	(unstable)	(not affected)
php7.1	source	(unstable)	(not affected)
php7.2	source	(unstable)	7.2.8-1

Notes

- php7.1 <not-affected> (Specific to 7.2.x)
- php7.0 <not-affected> (Specific to 7.2.x)
- php5 <not-affected> (Specific to 7.2.x)
PHP Bug: https://bugs.php.net/bug.php?id=76409
https://git.php.net/?p=php-src.git;a=commit;h=3fdde65617e9f954e2c964768aac8831005497e5