PT-2012-3994 · Php · Php

Jan Lieskovsky · Published 2012-05-21 · Updated 2017-08-29 · CVE-2012-2376

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.4.3

Description A buffer overflow issue exists in the com print typeinfo function, allowing remote attackers to execute arbitrary code via crafted arguments that trigger incorrect handling of COM object VARIANT types. This issue has been exploited in the wild.

Recommendations For versions prior to 5.4.3, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the com print typeinfo function until a patch is available.

Exploit

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2012-2376

Affected Products

Php

References · 9

• 🔥 https://exploit-db.com/exploits/18861 · Exploit
• 🔥 http://exploit-db.com/exploits/18861 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-2376 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75778 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=823464 · Note
• http://securitytracker.com/id?1027089 · Note
• http://openwall.com/lists/oss-security/2012/05/20/2 · Note
• http://isc.sans.edu/diary.html?storyid=13255 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2376 · Note