PT-2010-4052 · Php · Php

Tomas Hoger · Published 2010-08-20 · Updated 2016-08-23 · CVE-2010-2484

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.2.14

Description The issue allows context-dependent attackers to obtain sensitive information, such as memory contents, or trigger memory corruption. This can be achieved by causing a userspace interruption of an internal function or handler, specifically through the strrchr function.

Recommendations For PHP versions prior to 5.2.14, update to version 5.2.14 or later to resolve the issue. As a temporary workaround, consider restricting the use of the strrchr function until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2010-2484

Affected Products

Php

References · 10

• http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00000.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-2484 · Security Note
• http://marc.info/?l=bugtraq&m=133469208622507&w=2 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2010//Aug/msg00003.html · Vendor Advisory
• http://support.apple.com/kb/HT4312 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2484 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=619324 · Note
• http://php.net/releases/5_2_14.php · Note
• http://support.apple.com/kb/HT4435 · Note