NetSight
IP …
medium5.0

CVE-2013-6712

The scan function in ext/date/lib/parse_iso_intervals.c in PHP through 5.5.6 does not properly restrict creation of DateInterval objects, which might allow rem…

Impact

The scan function in ext/date/lib/parse_iso_intervals.c in PHP through 5.5.6 does not properly restrict creation of DateInterval objects, which might allow remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted interval specification.

Affected products

VendorProductAffected versions
PhpPhp
before 5.3.29
from 5.4.0 before 5.4.24
from 5.5.0 before 5.5.8
AppleMac Os X
through 10.10.2
OpensuseOpensuse
Versions 11.4, 12.2, 12.3, 13.1
CanonicalUbuntu Linux
Versions 10.04, 12.04, 12.10, 13.04, 13.10
DebianDebian Linux
Versions 6.0, 7.0

Weakness classification

CWE-119

References