CVE-2010-2225
HIGH
7.5
CVSS 2.0
Description
Use-after-free vulnerability in the SplObjectStorage unserializer in PHP 5.2.x and 5.3.x through 5.3.2 allows remote attackers to execute arbitrary code or obtain sensitive information via serialized data, related to the PHP unserialize function.
Affected products and versions
- PHP versions 5.2.0, 5.2.1, 5.2.2, 5.2.3, 5.2.4, 5.2.5, 5.2.6, 5.2.7, 5.2.8, 5.2.9, 5.2.10, 5.2.11, 5.2.12, 5.2.13, 5.3.0, 5.3.1, 5.3.2
References
- lists.apple.com http://lists.apple.com/archives/security-announce/2010//Aug/msg00003.html
- lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html
- lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00000.html
- marc.info http://marc.info/?l=bugtraq&m=133469208622507&w=2
- pastebin.com http://pastebin.com/mXGidCsd Exploit
- secunia.com http://secunia.com/advisories/40860
- support.apple.com http://support.apple.com/kb/HT4312
- twitter.com http://twitter.com/i0n1c/statuses/16373156076
- twitter.com http://twitter.com/i0n1c/statuses/16447867829
- www.debian.org http://www.debian.org/security/2010/dsa-2089
- www.securityfocus.com http://www.securityfocus.com/bid/40948
- bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=605641
- exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/59610
- nvd.nist.gov Official NVD record