PT-2013-1340 · Php · Php

Bluewind · Published 2013-06-21 · Updated 2013-06-24 · CVE-2013-4636

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions PHP versions 5.4.x before 5.4.16

Description The issue exists due to insufficient input validation in the mget function of the PHP interpreter. This can be exploited by a remote attacker to cause a denial of service, resulting in an application crash. The vulnerability is triggered when an MP3 file causes incorrect MIME type detection during access to an finfo object.

Recommendations For PHP versions 5.4.x before 5.4.16, update to version 5.4.16 or later to resolve the issue. As a temporary workaround, consider restricting access to MP3 files or disabling the mget function until a patch is available.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-02637

CVE-2013-4636

Affected Products

Php

References · 5

• https://bdu.fstec.ru/vul/2022-02637 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2013-4636 · Security Note
• http://php.net/ChangeLog-5.php · Note
• https://bugs.php.net/bug.php?id=64830 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4636 · Note