CVE-2013-6712 — Improper Restriction of Operations within the Bounds of a Memory Buffer in PHP

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-122 — Heap-based Buffer Overflow6 documents6 sources
Severity
5.0MEDIUMNVD
EPSS
17.3%
top 4.94%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
PHPApple MAC OS XApple OS X Yosemite V10.10.3 AND Security Update 2015-004+3 more
Timeline
PublishedNov 28
Latest updateMay 14

Description

The scan function in ext/date/lib/parse_iso_intervals.c in PHP through 5.5.6 does not properly restrict creation of DateInterval objects, which might allow remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted interval specification.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages4 packages

▶NVDphp/php5.4.0 — 5.4.24+2
▶NVDapple/mac_os_x10.10.2
▶NVDopensuse/opensuse4 versions+3

Also affects: Debian Linux 6.0, 7.0, Ubuntu Linux 10.04, 12.04, 12.10, 13.04, 13.10

Patches

Patch: bugs.php.net ↗Patch: bugs.php.net ↗

🔴Vulnerability Details

1
GHSA
GHSA-mfq9-hf75-jqcg: The scan function in ext/date/lib/parse_iso_intervals↗2022-05-14
▶

📋Vendor Advisories

3
Ubuntu
PHP vulnerabilities↗2013-12-12
▶
Red Hat
php: heap-based buffer over-read in DateInterval↗2013-11-27
▶
Apple
CVE-2013-6712: OS X Yosemite v10.10.3 and Security Update 2015-004↗
▶

💬Community

1
Bugzilla
CVE-2013-6712 php: heap-based buffer over-read in DateInterval↗2013-11-28
▶