blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2012-2336

MEDIUM 5.0 CVSS 2.0
Published
May 11, 2012
Last modified
June 16, 2026
NVD status
Modified
Reported by
secalert@redhat.com
Weakness
CWE-20
CVSS vector
AV:N/AC:L/Au:N/C:N/I:N/A:P

Description

sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to cause a denial of service (resource consumption) by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'T' case. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823.

Affected products and versions

  • PHP — Up to and including 5.3.12
  • PHP versions 1.0, 2.0, 2.0b10, 3.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.0.10, 3.0.11, 3.0.12, 3.0.13, 3.0.14, 3.0.15, 3.0.16, 3.0.17, 3.0.18, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.0.7, 4.0beta1, 4.0beta2, 4.0beta3, 4.0beta4, 4.0beta_4_patch1, 4.1.0, 4.1.1, 4.1.2, 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.3.0, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 4.3.8, 4.3.9, 4.3.10, 4.3.11, 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5, 4.4.6, 4.4.7, 4.4.8, 4.4.9, 5.0.0, 5.0.0beta1, 5.0.0beta2, 5.0.0beta3, 5.0.0beta4, 5.0.0rc1, 5.0.0rc2, 5.0.0rc3, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.1.0, 5.1.1, 5.1.2, 5.1.3, 5.1.4, 5.1.5, 5.1.6, 5.2.0, 5.2.1, 5.2.2, 5.2.3, 5.2.4, 5.2.5, 5.2.6, 5.2.7, 5.2.8, 5.2.9, 5.2.10, 5.2.11, 5.2.12, 5.2.13, 5.2.14, 5.2.15, 5.2.16, 5.2.17, 5.3.0, 5.3.1, 5.3.2, 5.3.3, 5.3.4, 5.3.5, 5.3.6, 5.3.7, 5.3.8, 5.3.9, 5.3.10, 5.3.11, 5.4.0, 5.4.0beta2, 5.4.1, 5.4.2

References

  • lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00004.html
  • lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00003.html
  • secunia.com http://secunia.com/advisories/49014 Vendor Advisory
  • www.php.net http://www.php.net/ChangeLog-5.php#5.4.3
  • www.php.net http://www.php.net/archive/2012.php#id2012-05-08-1 Vendor Advisory
  • bugs.php.net https://bugs.php.net/bug.php?id=61910 Vendor Advisory
  • bugs.php.net https://bugs.php.net/patch-display.php?bug_id=61910&patch=CVE-2012-1823.patch&revision=1336251592&display=1
  • h20564.www2.hp.com https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862
  • nvd.nist.gov Official NVD record