CVE-2011-0421
MEDIUM
4.3
CVSS 2.0
Description
The _zip_name_locate function in zip_name_locate.c in the Zip extension in PHP before 5.3.6 does not properly handle a ZIPARCHIVE::FL_UNCHANGED argument, which might allow context-dependent attackers to cause a denial of service (NULL pointer dereference) via an empty ZIP archive that is processed with a (1) locateName or (2) statName operation.
Affected products and versions
- PHP — Up to and including 5.3.5
- PHP versions 1.0, 2.0, 2.0b10, 3.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.0.10, 3.0.11, 3.0.12, 3.0.13, 3.0.14, 3.0.15, 3.0.16, 3.0.17, 3.0.18, 4.0, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.0.7, 4.0beta1, 4.0beta2, 4.0beta3, 4.0beta4, 4.0beta_4_patch1, 4.1.0, 4.1.1, 4.1.2, 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.3.0, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 4.3.8, 4.3.9, 4.3.10, 4.3.11, 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5, 4.4.6, 4.4.7, 4.4.8, 4.4.9, 5.0.0, 5.0.0beta1, 5.0.0beta2, 5.0.0beta3, 5.0.0beta4, 5.0.0rc1, 5.0.0rc2, 5.0.0rc3, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.1.0, 5.1.1, 5.1.2, 5.1.3, 5.1.4, 5.1.5, 5.1.6, 5.2.0, 5.2.1, 5.2.2, 5.2.3, 5.2.4, 5.2.5, 5.2.6, 5.2.7, 5.2.8, 5.2.9, 5.2.10, 5.2.11, 5.2.12, 5.2.13, 5.2.14, 5.2.15, 5.2.16, 5.2.17, 5.3.0, 5.3.1, 5.3.2, 5.3.3, 5.3.4
References
- bugs.php.net http://bugs.php.net/bug.php?id=53885 Exploit
- lists.apple.com http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html
- lists.fedoraproject.org http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057709.html
- lists.fedoraproject.org http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057710.html
- lists.fedoraproject.org http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056642.html
- lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html
- marc.info http://marc.info/?l=bugtraq&m=133469208622507&w=2
- secunia.com http://secunia.com/advisories/43621 Vendor Advisory
- securityreason.com http://securityreason.com/achievement_securityalert/96
- securityreason.com http://securityreason.com/securityalert/8146
- support.apple.com http://support.apple.com/kb/HT5002
- svn.php.net http://svn.php.net/viewvc/?view=revision&revision=307867 Patch
- www.debian.org http://www.debian.org/security/2011/dsa-2266
- www.exploit-db.com http://www.exploit-db.com/exploits/17004 Exploit
- www.mandriva.com http://www.mandriva.com/security/advisories?name=MDVSA-2011:052
- www.mandriva.com http://www.mandriva.com/security/advisories?name=MDVSA-2011:053
- www.mandriva.com http://www.mandriva.com/security/advisories?name=MDVSA-2011:099
- www.php.net http://www.php.net/ChangeLog-5.php
- www.php.net http://www.php.net/archive/2011.php
- www.php.net http://www.php.net/releases/5_3_6.php
- www.securityfocus.com http://www.securityfocus.com/archive/1/517065/100/0/threaded
- www.securityfocus.com http://www.securityfocus.com/bid/46354
- www.vupen.com http://www.vupen.com/english/advisories/2011/0744 Vendor Advisory
- www.vupen.com http://www.vupen.com/english/advisories/2011/0764 Vendor Advisory
- www.vupen.com http://www.vupen.com/english/advisories/2011/0890 Vendor Advisory
- bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=688735 Exploit, Patch
- exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/66173
- nvd.nist.gov Official NVD record