PT-2013-1899 · Php · Php

Attb2 + 1 · Published 2013-01-19 · Updated 2023-02-13 · CVE-2012-6113

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PHP versions 5.3.9 through 5.3.13

Description The issue concerns the openssl encrypt function, which fails to initialize a certain variable. This allows remote attackers to obtain sensitive information from process memory by providing zero bytes of input data.

Recommendations For PHP versions 5.3.9 through 5.3.13, consider updating to a version where this issue is fixed, as the provided information does not specify the exact fixed version. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2012-6113

Affected Products

Php

References · 7

• http://ubuntu.com/usn/USN-1702-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-6113 · Security Note
• http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=270a406ac94b5fc5cc9ef59fc61e3b4b95648a3e · Note
• http://openwall.com/lists/oss-security/2013/01/18/6 · Note
• https://bugs.launchpad.net/ubuntu/+source/php5/+bug/1099793 · Note
• https://bugs.php.net/bug.php?id=61413 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6113 · Note