blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2013-3735

HIGH 7.5 CVSS 3.1
Published
May 31, 2013
Last modified
June 16, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-20
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Description

The Zend Engine in PHP before 5.4.16 RC1, and 5.5.0 before RC2, does not properly determine whether a parser error occurred, which allows context-dependent attackers to cause a denial of service (memory consumption and application crash) via a crafted function definition, as demonstrated by an attack within a shared web-hosting environment. NOTE: the vendor's http://php.net/security-note.php page says "for critical security situations you should be using OS-level security by running multiple web servers each as their own user id.

Affected products and versions

  • PHP — Up to and including 5.4.15
  • PHP — Up to and including 5.5.0
  • PHP versions 5.4.0, 5.4.1, 5.4.2, 5.4.3, 5.4.4, 5.4.5, 5.4.6, 5.4.7, 5.4.8, 5.4.9, 5.4.10, 5.4.11, 5.4.12, 5.4.12rc1, 5.4.12rc2, 5.4.13, 5.4.13rc1, 5.4.14, 5.4.14rc1, 5.5.0alpha1, 5.5.0alpha2, 5.5.0alpha3, 5.5.0alpha4, 5.5.0alpha5, 5.5.0alpha6, 5.5.0beta1, 5.5.0beta2, 5.5.0beta3, 5.5.0beta4

References

  • bugs.php.net https://bugs.php.net/bug.php?id=64660
  • github.com https://github.com/php/php-src/blob/php-5.4.16RC1/NEWS
  • github.com https://github.com/php/php-src/blob/php-5.5.0RC2/NEWS
  • github.com https://github.com/php/php-src/commit/fb58e69a84f4fde603a630d2c9df2fa3be16d846 Exploit, Patch
  • nvd.nist.gov Official NVD record