CVE-2013-6712
The scan function in ext/date/lib/parse_iso_intervals.c in PHP through 5.5.6 does not properly restrict creation of DateInterval objects, which might allow remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted interval specification.
Published at
2013-11-28T04:37Z
3664 days ago
Modified
2022-10-31T15:01Z
404 days ago
CWE-119
Problem type
References
URL | Type |
---|---|
git.php.net http://git.php.net/?p=php-src.git;a=commit;h=12fe4e90be7bfa2a763197079f68f5568a14e071 | CONFIRM |
bugs.php.net https://bugs.php.net/bug.php?id=66060 | MISC |
openSUSE-SU-2013:1963 http://lists.opensuse.org/opensuse-updates/2013-12/msg00125.html | SUSE |
openSUSE-SU-2013:1964 http://lists.opensuse.org/opensuse-updates/2013-12/msg00126.html | SUSE |
RHSA-2014:1765 http://rhn.redhat.com/errata/RHSA-2014-1765.html | REDHAT |
support.apple.com https://support.apple.com/HT204659 | CONFIRM |
APPLE-SA-2015-04-08-2 http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html | APPLE |
SSRT101447 https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04463322 | HP |
USN-2055-1 http://www.ubuntu.com/usn/USN-2055-1 | UBUNTU |
DSA-2816 http://www.debian.org/security/2013/dsa-2816 | DEBIAN |
GET https://vulnerabilitydata.com/api/details/CVE-2013-6712
{ "id": "CVE-2013-6712", "published_date": "2013-11-28T04:37Z", "last_modified_date": "2022-10-31T15:01Z", "assigner": "cve@mitre.org", "description": "The scan function in ext/date/lib/parse_iso_intervals.c in PHP through 5.5.6 does not properly restrict creation of DateInterval objects, which might allow remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted interval specification.", "references": [ { "url": "http://git.php.net/?p=php-src.git;a=commit;h=12fe4e90be7bfa2a763197079f68f5568a14e071", "name": "http://git.php.net/?p=php-src.git;a=commit;h=12fe4e90be7bfa2a763197079f68f5568a14e071", "refsource": "CONFIRM", "tags": [ "Patch", "Vendor Advisory" ] }, { "url": "https://bugs.php.net/bug.php?id=66060", "name": "https://bugs.php.net/bug.php?id=66060", "refsource": "MISC", "tags": [ "Issue Tracking", "Patch", "Vendor Advisory" ] }, { "url": "http://lists.opensuse.org/opensuse-updates/2013-12/msg00125.html", "name": "openSUSE-SU-2013:1963", "refsource": "SUSE", "tags": [ "Mailing List", "Third Party Advisory" ] }, { "url": "http://lists.opensuse.org/opensuse-updates/2013-12/msg00126.html", "name": "openSUSE-SU-2013:1964", "refsource": "SUSE", "tags": [ "Mailing List", "Third Party Advisory" ] }, { "url": "http://rhn.redhat.com/errata/RHSA-2014-1765.html", "name": "RHSA-2014:1765", "refsource": "REDHAT", "tags": [ "Third Party Advisory" ] }, { "url": "https://support.apple.com/HT204659", "name": "https://support.apple.com/HT204659", "refsource": "CONFIRM", "tags": [ "Third Party Advisory" ] }, { "url": "http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html", "name": "APPLE-SA-2015-04-08-2", "refsource": "APPLE", "tags": [ "Mailing List", "Third Party Advisory" ] }, { "url": "https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04463322", "name": "SSRT101447", "refsource": "HP", "tags": [ "Third Party Advisory" ] }, { "url": "http://www.ubuntu.com/usn/USN-2055-1", "name": "USN-2055-1", "refsource": "UBUNTU", "tags": [ "Third Party Advisory" ] }, { "url": "http://www.debian.org/security/2013/dsa-2816", "name": "DSA-2816", "refsource": "DEBIAN", "tags": [ "Third Party Advisory" ] } ], "impact": { "baseMetricV2": { "cvssV2": { "version": "2.0", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "NONE", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5 }, "severity": "MEDIUM", "exploitabilityScore": 10, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false } }, "problem_type": "CWE-119" }