PHP CVEs

Description

Unspecified vulnerability in the Streams component in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (application crash) by accessing an ftp:// URL during use of an HTTP proxy with the FTP wrapper.

Affected products and versions

• PHP — Up to and including 5.3.5
• PHP versions 1.0, 2.0, 2.0b10, 3.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.0.10, 3.0.11, 3.0.12, 3.0.13, 3.0.14, 3.0.15, 3.0.16, 3.0.17, 3.0.18, 4.0, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.0.7, 4.0beta1, 4.0beta2, 4.0beta3, 4.0beta4, 4.0beta_4_patch1, 4.1.0, 4.1.1, 4.1.2, 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.3.0, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 4.3.8, 4.3.9, 4.3.10, 4.3.11, 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5, 4.4.6, 4.4.7, 4.4.8, 4.4.9, 5.0.0, 5.0.0beta1, 5.0.0beta2, 5.0.0beta3, 5.0.0beta4, 5.0.0rc1, 5.0.0rc2, 5.0.0rc3, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.1.0, 5.1.1, 5.1.2, 5.1.3, 5.1.4, 5.1.5, 5.1.6, 5.2.0, 5.2.1, 5.2.2, 5.2.3, 5.2.4, 5.2.5, 5.2.6, 5.2.7, 5.2.8, 5.2.9, 5.2.10, 5.2.11, 5.2.12, 5.2.13, 5.2.14, 5.2.15, 5.2.16, 5.2.17, 5.3.0, 5.3.1, 5.3.2, 5.3.3, 5.3.4

References

• bugs.php.net http://bugs.php.net/bug.php?id=54092 Exploit
• lists.apple.com http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html
• support.apple.com http://support.apple.com/kb/HT5002
• www.mandriva.com http://www.mandriva.com/security/advisories?name=MDVSA-2011:052
• www.mandriva.com http://www.mandriva.com/security/advisories?name=MDVSA-2011:053
• www.php.net http://www.php.net/ChangeLog-5.php
• www.redhat.com http://www.redhat.com/support/errata/RHSA-2011-1423.html
• www.securityfocus.com http://www.securityfocus.com/bid/46970
• www.vupen.com http://www.vupen.com/english/advisories/2011/0744
• nvd.nist.gov Official NVD record