PT-2013-1337 · Php · Php

Published 2013-05-31 · Updated 2025-01-16 · CVE-2013-3735

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.4.16 RC1 PHP versions prior to 5.5.0 RC2

Description The issue exists due to insufficient input validation in the Zend Engine component of the PHP programming language interpreter. This can be exploited by a remote attacker to cause a denial of service, resulting in memory consumption and application crash, via a crafted function definition. The attack can be demonstrated within a shared web-hosting environment. It is recommended to use OS-level security by running multiple web servers each as their own user ID for critical security situations.

Recommendations For PHP versions prior to 5.4.16 RC1, update to version 5.4.16 RC1 or later. For PHP versions prior to 5.5.0 RC2, update to version 5.5.0 RC2 or later. As a temporary workaround, consider restricting the use of crafted function definitions to minimize the risk of exploitation.

Exploit

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-02634

CVE-2013-3735

Affected Products

Php

References · 8

• 🔥 https://github.com/php/php-src/commit/fb58e69a84f4fde603a630d2c9df2fa3be16d846 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-3735 · Security Note
• https://bdu.fstec.ru/vul/2022-02634 · Security Note
• https://github.com/php/php-src/blob/php-5.5.0RC2/NEWS · Note
• https://github.com/php/php-src/blob/php-5.4.16RC1/NEWS · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3735 · Note
• https://t.me/cvenotify/89464 · Telegram Post
• https://bugs.php.net/bug.php?id=64660 · Note