PT-2010-4084 · Php+1 · Php+1

Published 2010-08-20 · Updated 2023-01-19 · CVE-2010-2531

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PHP versions 5.2.0 through 5.2.13 PHP versions 5.3.0 through 5.3.2

Description The issue allows remote attackers to obtain sensitive information by causing the application to exceed limits for memory, execution time, or recursion, due to the var export function flushing the output buffer to the user when certain fatal errors occur, even if display errors is off.

Recommendations For PHP versions 5.2.0 through 5.2.13, update to version 5.2.14 or later. For PHP versions 5.3.0 through 5.3.2, update to version 5.3.3 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2010-2531

DSA-2266-1

RHSA-2010:0919

RHSA-2010_0919

Affected Products

Php

Red Hat

References · 41

• https://bdu.fstec.ru/vul/2022-02600 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00000.html · Vendor Advisory
• http://debian.org/security/2011/dsa-2266 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2010-0919.html · Vendor Advisory
• http://svn.php.net/viewvc/php/php-src/trunk/ext/standard/tests/general_functions/var_export_error2.phpt?view=log&pathrev=301143 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=133469208622507&w=2 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html · Vendor Advisory
• http://marc.info/?l=bugtraq&m=130331363227777&w=2 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2010//Aug/msg00003.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-2531 · Security Note
• http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html · Vendor Advisory
• http://php.net/archive/2010.php#id2010-07-22-2 · Vendor Advisory
• http://php.net/archive/2010.php#id2010-07-22-1 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2010-1917 · Note
• https://access.redhat.com/security/cve/CVE-2010-0397 · Note