PT-2011-4415 · Php · Php

Vincent Danen · Published 2011-11-03 · Updated 2024-06-15 · CVE-2011-3379

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP versions 5.3.7 through 5.3.8

Description The issue allows remote attackers to execute arbitrary code by providing a crafted URL. This is made possible by the is a function triggering a call to the autoload function, which can lead to potentially unsafe behavior in certain PEAR packages and custom autoloaders.

Recommendations For PHP versions 5.3.7 and 5.3.8, consider disabling the autoload function or restricting its use until a patch is available. Additionally, review and update any custom autoloaders to prevent potentially unsafe behavior.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2011-3379

OPENSUSE-SU-2024:10290-1

OPENSUSE-SU-2024:10344-1

OPENSUSE-SU-2024:11169-1

Affected Products

Php

References · 127

• 🔥 http://byte.nl/blog/2011/09/23/security-bug-in-is_a-function-in-php-5-3-7-5-3-8 · Exploit
• 🔥 https://bugs.php.net/bug.php?id=55475 · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2024:10290-1 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=741020 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2024:10344-1 · Vendor Advisory
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041 · Vendor Advisory
• http://svn.php.net/viewvc/?view=revision&revision=317183 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2024:11169-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-3379 · Security Note
• https://suse.com/security/cve/CVE-2014-3622 · Note
• https://suse.com/security/cve/CVE-2019-9020 · Note
• https://suse.com/security/cve/CVE-2010-2225 · Note
• https://suse.com/security/cve/CVE-2012-3365 · Note
• https://suse.com/security/cve/CVE-2010-3710 · Note
• https://suse.com/security/cve/CVE-2006-1494 · Note