PT-2013-1340 · Php · Php

Bluewind · Publicado 2013-06-21 · Atualizado 2013-06-24 · CVE-2013-4636

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions PHP versions 5.4.x before 5.4.16

Description The issue exists due to insufficient input validation in the mget function of the PHP interpreter. This can be exploited by a remote attacker to cause a denial of service, resulting in an application crash. The vulnerability is triggered when an MP3 file causes incorrect MIME type detection during access to an finfo object.

Recommendations For PHP versions 5.4.x before 5.4.16, update to version 5.4.16 or later to resolve the issue. As a temporary workaround, consider restricting access to MP3 files or disabling the mget function until a patch is available.

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2022-02637

CVE-2013-4636

Produtos afetados

Php

Referências · 5

• http://php.net/ChangeLog-5.php · Nota
• https://bugs.php.net/bug.php?id=64830 · Nota
• https://bdu.fstec.ru/vul/2022-02637 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2013-4636 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4636 · Nota