PT-2010-3487 · Php · Php

Published 2010-05-07 · Updated 2010-05-10 · CVE-2010-1861

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHP versions 5.2 through 5.2.13 PHP versions 5.3 through 5.3.2

Description The issue allows context-dependent attackers to write to arbitrary memory addresses. This is achieved by using an object's sleep function to interrupt an internal call to the shm put var function, triggering access of a freed resource.

Recommendations For PHP versions 5.2 through 5.2.13, update to a version later than 5.2.13 to resolve the issue. For PHP versions 5.3 through 5.3.2, update to a version later than 5.3.2 to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2010-1861

Affected Products

Php

References · 3

• 🔥 http://php-security.org/2010/05/05/mops-2010-009-php-shm_put_var-already-freed-resource-access-vulnerability/index.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-1861 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1861 · Note