PT-2014-8652 · Php+1 · Php+1
Publicado
2014-11-06
·
Atualizado
2015-04-30
·
CVE-2014-8626
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
PHP versions prior to 5.2.7
Description
The issue is related to a stack-based buffer overflow in the date from ISO8601 function, which can be triggered by including a timezone field in a date. This leads to improper XML-RPC encoding and can cause a denial of service, resulting in an application crash, or potentially allow the execution of arbitrary code.
Recommendations
For versions prior to 5.2.7, update to version 5.2.7 or later to resolve the issue. As a temporary workaround, consider restricting the use of the date from ISO8601 function until a patch is applied. Avoid including timezone fields in dates to minimize the risk of exploitation.
Exploit
Correção
DoS
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Php
Red Hat