SB2012020206 - Multiple vulnerabilities in PHP

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2012020206

SB2012020206 - Multiple vulnerabilities in PHP

Published: February 2, 2012 Updated: August 11, 2020

Security Bulletin ID SB2012020206
Severity
Medium
Patch available
NO
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Input validation error (CVE-ID: CVE-2012-0788)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The PDORow implementation in PHP before 5.3.9 does not properly interact with the session feature, which allows remote attackers to cause a denial of service (application crash) via a crafted application that uses a PDO driver for a fetch and then calls the session_start function, as demonstrated by a crash of the Apache HTTP Server.


2) Memory leak (CVE-ID: CVE-2012-0789)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the timezone functionality in PHP before 5.3.9 allows remote attackers to cause a denial of service (memory consumption) by triggering many strtotime function calls, which are not properly handled by the php_date_parse_tzfile cache. A remote attacker can perform a denial of service attack.


3) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2012-0057)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

PHP before 5.3.9 has improper libxslt security settings, which allows remote attackers to create arbitrary files via a crafted XSLT stylesheet that uses the libxslt output extension.


Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References