medium4.3Public exploit code

CVE-2011-1468

Multiple memory leaks in the OpenSSL extension in PHP before 5.3.6 might allow remote attackers to cause a denial of service (memory consumption) via (1) plain…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

PHP < 5.3.6 'OpenSSL' Extension - 'openssl_decrypt' Ciphertext Data Memory Leak Denial of Service2011-03-08 · dos · php · Verified
PHP < 5.3.6 'OpenSSL' Extension - 'openssl_encrypt' Plaintext Data Memory Leak Denial of Service2011-03-08 · dos · php · Verified

Impact

Multiple memory leaks in the OpenSSL extension in PHP before 5.3.6 might allow remote attackers to cause a denial of service (memory consumption) via (1) plaintext data to the openssl_encrypt function or (2) ciphertext data to the openssl_decrypt function.

Affected products

Vendor	Product	Affected versions
Php	Php	through 5.3.5 Versions 1.0, 2.0, 2.0b10, 3.0, 3.0.1

Weakness classification

CWE-399

Public exploit code

Impact

Affected products

Weakness classification

References