CVE-2009-2687: debian debian_linux Improper Input Validation

Modified

Published 05-08-2009Last modified 07-08-2024

Vulnerability summary

CVE-2009-2687 is a medium (CVSS 4.3) Improper Input Validation vulnerability in debian debian_linux. EPSS estimates a 4.38% chance of exploitation in the next 30 days, higher than 91.2% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Routine

Not severe (CVSS 4.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

4.3/10

010

Medium · v2.0 (NVD)

EPSS score

4.38%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 3

DSA-1940-1 RHSA-2009:1461 RHSA-2010:0040

Timeline

05-08-2009
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

The exif_read_data function in the Exif module in PHP before 5.2.10 allows remote attackers to cause a denial of service (crash) via a malformed JPEG image with invalid offset fields, a different issue than CVE-2005-3353.

CVSS metrics

1 score · 1 source · 1 version

v2.04.3

EPSS trend

Probability

4.38%

Chance of exploitation in the next 30 days

Percentile

91%

Versus all other CVEs

30-day change

No change 0.00 pp

From 4.38% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

referenceUnverified
Exploit Reference (bugs.php.net)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Debian1 product

debian_linuxEOL4.0 | 5.0 | 6.0

Php1 product

php< 5.2.10

2 vendors · 2 products

References

18 links

usn.ubuntu.com/824-1/Vendor AdvisoryX Refsource UBUNTUBroken Link
secunia.com/advisories/37482Third Party AdvisoryX Refsource SECUNIABroken Link
secunia.com/advisories/40262Third Party AdvisoryX Refsource SECUNIABroken Link
bugs.php.net/bug.php?id=48378X Refsource CONFIRMExploitVendor Advisory
marc.info?l=bugtraq&m=127680701405735&w=2Vendor AdvisoryX Refsource HPMailing ListThird Party Advisory
www.mandriva.com/security/advisories?name=MDVSA-2009:145Vendor AdvisoryX Refsource MANDRIVABroken Link
www.vupen.com/english/advisories/2009/1632VDB EntryX Refsource VUPENPatchVendor Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6655VDB EntrySignatureX Refsource OVALThird Party Advisory
secunia.com/advisories/36462Third Party AdvisoryX Refsource SECUNIABroken Link
www.debian.org/security/2009/dsa-1940Vendor AdvisoryX Refsource DEBIANThird Party Advisory

Show all 18 references

osvdb.org/55222VDB EntryX Refsource OSVDBBroken Link
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10695VDB EntrySignatureX Refsource OVALThird Party Advisory
secunia.com/advisories/35441Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
www.mandriva.com/security/advisories?name=MDVSA-2009:167Vendor AdvisoryX Refsource MANDRIVABroken Link
www.securityfocus.com/bid/35440VDB EntryX Refsource BIDPatchThird Party Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/51253VDB EntryX Refsource XFThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
www.php.net/releases/5_2_10.phpX Refsource CONFIRMPatchVendor Advisory