PHP CVEs

Description

Memory leak in the timezone functionality in PHP before 5.3.9 allows remote attackers to cause a denial of service (memory consumption) by triggering many strtotime function calls, which are not properly handled by the php_date_parse_tzfile cache.

Affected products and versions

• PHP — Up to and including 5.3.8
• PHP versions 5.0.0, 5.0.0beta1, 5.0.0beta2, 5.0.0beta3, 5.0.0beta4, 5.0.0rc1, 5.0.0rc2, 5.0.0rc3, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.1.1, 5.1.2, 5.1.3, 5.1.4, 5.1.5, 5.1.6, 5.2.0, 5.2.1, 5.2.2, 5.2.3, 5.2.4, 5.2.5, 5.2.6, 5.2.7, 5.2.8, 5.2.9, 5.2.10, 5.2.11, 5.2.12, 5.2.14, 5.2.15, 5.2.16, 5.2.17, 5.3.0, 5.3.1, 5.3.2, 5.3.3, 5.3.4, 5.3.5, 5.3.6, 5.3.7

References

• lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00013.html
• lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00016.html
• secunia.com http://secunia.com/advisories/48668
• www.php.net http://www.php.net/ChangeLog-5.php#5.3.9
• bugs.php.net https://bugs.php.net/bug.php?id=53502 Exploit
• bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=783609 Exploit
• nvd.nist.gov Official NVD record