fkie_cve-2013-6420
Vulnerability from fkie_nvd
Published
2013-12-17 04:46
Modified
2024-11-21 01:59
Severity ?
Summary
The asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse (1) notBefore and (2) notAfter timestamps in X.509 certificates, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted certificate that is not properly handled by the openssl_x509_parse function.
References
secalert@redhat.comhttp://forums.interworx.com/threads/8000-InterWorx-Version-5-0-14-Released-on-Beta-Channel%21
secalert@redhat.comhttp://git.php.net/?p=php-src.git%3Ba=commit%3Bh=c1224573c773b6845e83505f717fbf820fc18415
secalert@redhat.comhttp://lists.opensuse.org/opensuse-updates/2013-12/msg00125.html
secalert@redhat.comhttp://lists.opensuse.org/opensuse-updates/2013-12/msg00126.html
secalert@redhat.comhttp://rhn.redhat.com/errata/RHSA-2013-1813.html
secalert@redhat.comhttp://rhn.redhat.com/errata/RHSA-2013-1815.html
secalert@redhat.comhttp://rhn.redhat.com/errata/RHSA-2013-1824.html
secalert@redhat.comhttp://rhn.redhat.com/errata/RHSA-2013-1825.html
secalert@redhat.comhttp://rhn.redhat.com/errata/RHSA-2013-1826.html
secalert@redhat.comhttp://secunia.com/advisories/59652
secalert@redhat.comhttp://support.apple.com/kb/HT6150
secalert@redhat.comhttp://www.debian.org/security/2013/dsa-2816
secalert@redhat.comhttp://www.php.net/ChangeLog-5.php
secalert@redhat.comhttp://www.securityfocus.com/bid/64225
secalert@redhat.comhttp://www.securitytracker.com/id/1029472
secalert@redhat.comhttp://www.ubuntu.com/usn/USN-2055-1
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=1036830Patch
secalert@redhat.comhttps://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04463322
secalert@redhat.comhttps://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04463322
secalert@redhat.comhttps://www.sektioneins.de/advisories/advisory-012013-php-openssl_x509_parse-memory-corruption-vulnerability.htmlExploit
af854a3a-2127-422b-91ae-364da2661108http://forums.interworx.com/threads/8000-InterWorx-Version-5-0-14-Released-on-Beta-Channel%21
af854a3a-2127-422b-91ae-364da2661108http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=c1224573c773b6845e83505f717fbf820fc18415
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-updates/2013-12/msg00125.html
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-updates/2013-12/msg00126.html
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2013-1813.html
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2013-1815.html
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2013-1824.html
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2013-1825.html
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2013-1826.html
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/59652
af854a3a-2127-422b-91ae-364da2661108http://support.apple.com/kb/HT6150
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2013/dsa-2816
af854a3a-2127-422b-91ae-364da2661108http://www.php.net/ChangeLog-5.php
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/64225
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1029472
af854a3a-2127-422b-91ae-364da2661108http://www.ubuntu.com/usn/USN-2055-1
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=1036830Patch
af854a3a-2127-422b-91ae-364da2661108https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04463322
af854a3a-2127-422b-91ae-364da2661108https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04463322
af854a3a-2127-422b-91ae-364da2661108https://www.sektioneins.de/advisories/advisory-012013-php-openssl_x509_parse-memory-corruption-vulnerability.htmlExploit
Impacted products
Vendor Product Version
php php 5.4.0
php php 5.4.1
php php 5.4.2
php php 5.4.3
php php 5.4.4
php php 5.4.5
php php 5.4.6
php php 5.4.7
php php 5.4.8
php php 5.4.9
php php 5.4.10
php php 5.4.11
php php 5.4.12
php php 5.4.12
php php 5.4.12
php php 5.4.13
php php 5.4.13
php php 5.4.14
php php 5.4.14
php php 5.4.15
php php 5.4.15
php php 5.4.16
php php 5.4.16
php php 5.4.17
php php 5.4.18
php php 5.4.19
php php 5.4.20
php php 5.4.21
php php 5.4.22
opensuse opensuse 11.4
opensuse opensuse 12.2
opensuse opensuse 12.3
opensuse opensuse 13.1
apple mac_os_x *
php php *
php php 5.3.0
php php 5.3.1
php php 5.3.2
php php 5.3.3
php php 5.3.4
php php 5.3.5
php php 5.3.6
php php 5.3.7
php php 5.3.8
php php 5.3.9
php php 5.3.10
php php 5.3.11
php php 5.3.12
php php 5.3.13
php php 5.3.14
php php 5.3.15
php php 5.3.16
php php 5.3.17
php php 5.3.18
php php 5.3.19
php php 5.3.20
php php 5.3.21
php php 5.3.22
php php 5.3.23
php php 5.3.24
php php 5.3.25
php php 5.3.26
php php 5.5.0
php php 5.5.0
php php 5.5.0
php php 5.5.0
php php 5.5.0
php php 5.5.0
php php 5.5.0
php php 5.5.0
php php 5.5.0
php php 5.5.0
php php 5.5.0
php php 5.5.0
php php 5.5.0
php php 5.5.1
php php 5.5.2
php php 5.5.3
php php 5.5.4
php php 5.5.5
php php 5.5.6


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:php:php:5.4.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "E7B9B8D2-78B7-4B17-955B-741C7A6F6634",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.4.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "5CA2A940-BD69-4D35-AF12-432CB929248B",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.4.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "29BD13F9-86C8-44C4-A860-9A87870A518E",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.4.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "1B361FDE-9F6A-4E9A-96F1-619DC56EECB6",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.4.4:*:*:*:*:*:*:*",
                     matchCriteriaId: "3DBD9E7B-1237-47A8-8A07-5CC5246A9C5A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.4.5:*:*:*:*:*:*:*",
                     matchCriteriaId: "6F2BB41E-2096-4291-B0ED-06825FDFE8BF",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.4.6:*:*:*:*:*:*:*",
                     matchCriteriaId: "52BA94F7-1AF9-415C-AC21-30BC25C74C5D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.4.7:*:*:*:*:*:*:*",
                     matchCriteriaId: "D0A739A0-698A-422B-886B-430A79F6E945",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.4.8:*:*:*:*:*:*:*",
                     matchCriteriaId: "086E0D24-A43E-4CEA-9FB0-FE193B88CC31",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.4.9:*:*:*:*:*:*:*",
                     matchCriteriaId: "EC8D0963-8CA5-4814-9B6D-4E1C3907737B",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.4.10:*:*:*:*:*:*:*",
                     matchCriteriaId: "77A4B7E0-C872-4E53-AD72-1BB2755E4FDA",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.4.11:*:*:*:*:*:*:*",
                     matchCriteriaId: "EECCD553-53D5-485E-8C21-E2A5070833B2",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.4.12:*:*:*:*:*:*:*",
                     matchCriteriaId: "95357C79-A754-4E0C-B65B-0FA241962B12",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.4.12:rc1:*:*:*:*:*:*",
                     matchCriteriaId: "25EAF9A9-F7A1-4AC7-BCFD-769BE0FDB537",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.4.12:rc2:*:*:*:*:*:*",
                     matchCriteriaId: "74EA8037-7C22-48B3-9FA2-4BFFFFD513D1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.4.13:*:*:*:*:*:*:*",
                     matchCriteriaId: "C8D1254E-0C72-4958-BA7F-5B818C3ACB15",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.4.13:rc1:*:*:*:*:*:*",
                     matchCriteriaId: "92994FFC-F362-48AC-9CA8-8EBCAC880C91",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.4.14:*:*:*:*:*:*:*",
                     matchCriteriaId: "21131DF1-1EE5-4C84-B1E0-FA75BC39B344",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.4.14:rc1:*:*:*:*:*:*",
                     matchCriteriaId: "0B23F85D-465B-4176-9798-E78AADE421EC",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.4.15:*:*:*:*:*:*:*",
                     matchCriteriaId: "08A0FB69-9BB2-4CCA-87C5-18368109D6E8",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.4.15:rc1:*:*:*:*:*:*",
                     matchCriteriaId: "ADEE52B4-8392-4321-8C00-FABA6270E728",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.4.16:*:*:*:*:*:*:*",
                     matchCriteriaId: "43A4C220-AF4F-4DB0-A66A-175C8EF6CEB2",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.4.16:rc1:*:*:*:*:*:*",
                     matchCriteriaId: "57D74F58-DB3A-4A70-93CF-B350DB65EF49",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.4.17:*:*:*:*:*:*:*",
                     matchCriteriaId: "AAEE86A0-C3FC-446E-8DF0-4FA32F741E1B",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.4.18:*:*:*:*:*:*:*",
                     matchCriteriaId: "90B670B6-A211-40C6-A8A0-1B0188EF891F",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.4.19:*:*:*:*:*:*:*",
                     matchCriteriaId: "AAAC4776-F3FF-42D8-AC6E-4746987D30BF",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.4.20:*:*:*:*:*:*:*",
                     matchCriteriaId: "41DC16B7-7A45-4BDE-B340-F17D97CA3BDD",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.4.21:*:*:*:*:*:*:*",
                     matchCriteriaId: "0FD7C2E6-9B34-4890-A0D1-39BB8ECA47E4",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.4.22:*:*:*:*:*:*:*",
                     matchCriteriaId: "4F8F72EC-7431-4B36-89EF-E7593ACFBFEA",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*",
                     matchCriteriaId: "DE554781-1EB9-446E-911F-6C11970C47F4",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "D806A17E-B8F9-466D-807D-3F1E77603DC8",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "DFBF430B-0832-44B0-AA0E-BA9E467F7668",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "A10BC294-9196-425F-9FB0-B1625465B47F",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "C8303A91-5C8F-4709-83D6-3D211F9C57EE",
                     versionEndIncluding: "10.9.1",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "405D31DC-4338-4CF2-BBB3-C118C191AC44",
                     versionEndIncluding: "5.3.27",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.3.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "9EF4B938-BB14-4C06-BEE9-10CA755C5DEF",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.3.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "981C922C-7A7D-473E-8C43-03AB62FB5B8B",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.3.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "5D0CD11A-09C2-4C60-8F0C-68E55BD6EE63",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.3.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "B0F40E4A-E125-4099-A8B3-D42614AA9312",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.3.4:*:*:*:*:*:*:*",
                     matchCriteriaId: "4933D9DD-A630-4A3D-9D13-9E182F5F6F8C",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.3.5:*:*:*:*:*:*:*",
                     matchCriteriaId: "A9E6D530-91FC-42F4-A427-6601238E0187",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.3.6:*:*:*:*:*:*:*",
                     matchCriteriaId: "9EC938DB-E066-407F-BDF8-61A1C41136F7",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.3.7:*:*:*:*:*:*:*",
                     matchCriteriaId: "ACDF768D-7F5A-4042-B7DD-398F65F3F094",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.3.8:*:*:*:*:*:*:*",
                     matchCriteriaId: "2AF35BB6-C6B1-4683-A8BE-AA72CC34F5B5",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.3.9:*:*:*:*:*:*:*",
                     matchCriteriaId: "EC3F1891-032D-409C-904C-A415D2323DFC",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.3.10:*:*:*:*:*:*:*",
                     matchCriteriaId: "4B13826D-06B2-4A46-AB24-092F6935958D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.3.11:*:*:*:*:*:*:*",
                     matchCriteriaId: "1B6528FC-51BE-4E30-B282-D9841553BA26",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.3.12:*:*:*:*:*:*:*",
                     matchCriteriaId: "66CF9452-6225-4726-822B-C7CD620A1D6E",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.3.13:*:*:*:*:*:*:*",
                     matchCriteriaId: "A953FF53-1106-42D3-BE4A-4F27C7C42F52",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.3.14:*:*:*:*:*:*:*",
                     matchCriteriaId: "D4D2F015-A38D-43C6-ADC6-A0EFCE150071",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.3.15:*:*:*:*:*:*:*",
                     matchCriteriaId: "75A8FF8E-A26A-45AD-BD91-9B4822581CE2",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.3.16:*:*:*:*:*:*:*",
                     matchCriteriaId: "5F27C2F9-73BE-46EF-B5ED-8D407D22D12E",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.3.17:*:*:*:*:*:*:*",
                     matchCriteriaId: "EB212796-B71B-4F6B-9156-9C5178FF0931",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.3.18:*:*:*:*:*:*:*",
                     matchCriteriaId: "DFBCD79D-3821-4538-B6F1-49F51E5983E3",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.3.19:*:*:*:*:*:*:*",
                     matchCriteriaId: "B66E709F-E34E-4744-8970-0F70F95A8761",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.3.20:*:*:*:*:*:*:*",
                     matchCriteriaId: "D20691D0-3102-4E82-BED9-9E7B67F9F778",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.3.21:*:*:*:*:*:*:*",
                     matchCriteriaId: "6DA7831F-5F53-4A29-9AB1-913EBD095589",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.3.22:*:*:*:*:*:*:*",
                     matchCriteriaId: "F798EC96-FC60-47BA-AE27-8C2261D9E5D8",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.3.23:*:*:*:*:*:*:*",
                     matchCriteriaId: "633BEAF3-C73C-48FC-B623-375B9F79C93D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.3.24:*:*:*:*:*:*:*",
                     matchCriteriaId: "965BB50E-7675-43A7-B074-98BCB1EBA311",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.3.25:*:*:*:*:*:*:*",
                     matchCriteriaId: "B52F6124-1C8E-4568-BACF-A463064DA48E",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.3.26:*:*:*:*:*:*:*",
                     matchCriteriaId: "2BA2F96C-A676-4F13-8E41-600461338B1A",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:php:php:5.5.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "9F6D9B19-E64D-4BED-9194-17460CE19E6F",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.5.0:alpha1:*:*:*:*:*:*",
                     matchCriteriaId: "3D25E591-448C-4E3B-8557-6E48F7571796",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.5.0:alpha2:*:*:*:*:*:*",
                     matchCriteriaId: "6DA18F3F-B4B5-40C3-BF19-67C1F0C1787D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.5.0:alpha3:*:*:*:*:*:*",
                     matchCriteriaId: "3AF783C9-26E7-4E02-BD41-77B9783667E3",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.5.0:alpha4:*:*:*:*:*:*",
                     matchCriteriaId: "EF49701D-ECE4-4CEB-BDAB-24C09C8AD4B4",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.5.0:alpha5:*:*:*:*:*:*",
                     matchCriteriaId: "7AEDF6F7-001D-4A35-A26F-417991AD377F",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.5.0:alpha6:*:*:*:*:*:*",
                     matchCriteriaId: "4031DB99-B4B4-41EC-B3C1-543D92C575A9",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.5.0:beta1:*:*:*:*:*:*",
                     matchCriteriaId: "D5450EA7-A398-49D2-AA8E-7C95B074BAB1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.5.0:beta2:*:*:*:*:*:*",
                     matchCriteriaId: "04FE0E4E-BC94-4DC9-BE9B-DC57B952B2FB",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.5.0:beta3:*:*:*:*:*:*",
                     matchCriteriaId: "BB8E09D8-9CBE-4279-88B7-24A214A5A537",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.5.0:beta4:*:*:*:*:*:*",
                     matchCriteriaId: "2D41ECCE-887D-49A2-9BB3-B559495AC55B",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.5.0:rc1:*:*:*:*:*:*",
                     matchCriteriaId: "79B418BC-27F4-4443-A0F7-FF4ADA568C1B",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.5.0:rc2:*:*:*:*:*:*",
                     matchCriteriaId: "8EEBDF62-BA1B-4438-9AEA-8B56AA5713E8",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.5.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "F644EA6C-50C6-4A1C-A4AC-287AA9477B46",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.5.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "4DD47F30-74F5-48E8-8657-C2373FE2BD22",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.5.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "0C09527B-6B47-41F8-BDE6-01C47E452286",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.5.4:*:*:*:*:*:*:*",
                     matchCriteriaId: "2E454D87-23CB-4D7F-90FE-942EE54D661F",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.5.5:*:*:*:*:*:*:*",
                     matchCriteriaId: "1031E646-F2CF-4A3E-8E6A-5D4BC950BEDA",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:php:php:5.5.6:*:*:*:*:*:*:*",
                     matchCriteriaId: "130E50C1-D209-4CFF-9399-69D561340FBB",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "The asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse (1) notBefore and (2) notAfter timestamps in X.509 certificates, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted certificate that is not properly handled by the openssl_x509_parse function.",
      },
      {
         lang: "es",
         value: "La función asn1_time_to_time_t en ext / openssl / openssl.c en PHP anterior a 5.3.28, 5.4.x aterior a 5.4.23 y 5.5.x anterior de 5.5.7 no trata correctamente las marcas de tiempo (timestamps)  (1) notBefore y (2) notAfter  en certificados X 0.509 , lo que permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (corrupción de memoria) a través de un certificado manipulado que no está tratado adecuadamente  por  la función openssl_x509_parse.",
      },
   ],
   id: "CVE-2013-6420",
   lastModified: "2024-11-21T01:59:11.413",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "HIGH",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 7.5,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 6.4,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
   },
   published: "2013-12-17T04:46:45.877",
   references: [
      {
         source: "secalert@redhat.com",
         url: "http://forums.interworx.com/threads/8000-InterWorx-Version-5-0-14-Released-on-Beta-Channel%21",
      },
      {
         source: "secalert@redhat.com",
         url: "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=c1224573c773b6845e83505f717fbf820fc18415",
      },
      {
         source: "secalert@redhat.com",
         url: "http://lists.opensuse.org/opensuse-updates/2013-12/msg00125.html",
      },
      {
         source: "secalert@redhat.com",
         url: "http://lists.opensuse.org/opensuse-updates/2013-12/msg00126.html",
      },
      {
         source: "secalert@redhat.com",
         url: "http://rhn.redhat.com/errata/RHSA-2013-1813.html",
      },
      {
         source: "secalert@redhat.com",
         url: "http://rhn.redhat.com/errata/RHSA-2013-1815.html",
      },
      {
         source: "secalert@redhat.com",
         url: "http://rhn.redhat.com/errata/RHSA-2013-1824.html",
      },
      {
         source: "secalert@redhat.com",
         url: "http://rhn.redhat.com/errata/RHSA-2013-1825.html",
      },
      {
         source: "secalert@redhat.com",
         url: "http://rhn.redhat.com/errata/RHSA-2013-1826.html",
      },
      {
         source: "secalert@redhat.com",
         url: "http://secunia.com/advisories/59652",
      },
      {
         source: "secalert@redhat.com",
         url: "http://support.apple.com/kb/HT6150",
      },
      {
         source: "secalert@redhat.com",
         url: "http://www.debian.org/security/2013/dsa-2816",
      },
      {
         source: "secalert@redhat.com",
         url: "http://www.php.net/ChangeLog-5.php",
      },
      {
         source: "secalert@redhat.com",
         url: "http://www.securityfocus.com/bid/64225",
      },
      {
         source: "secalert@redhat.com",
         url: "http://www.securitytracker.com/id/1029472",
      },
      {
         source: "secalert@redhat.com",
         url: "http://www.ubuntu.com/usn/USN-2055-1",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Patch",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=1036830",
      },
      {
         source: "secalert@redhat.com",
         url: "https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04463322",
      },
      {
         source: "secalert@redhat.com",
         url: "https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04463322",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Exploit",
         ],
         url: "https://www.sektioneins.de/advisories/advisory-012013-php-openssl_x509_parse-memory-corruption-vulnerability.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://forums.interworx.com/threads/8000-InterWorx-Version-5-0-14-Released-on-Beta-Channel%21",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=c1224573c773b6845e83505f717fbf820fc18415",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://lists.opensuse.org/opensuse-updates/2013-12/msg00125.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://lists.opensuse.org/opensuse-updates/2013-12/msg00126.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://rhn.redhat.com/errata/RHSA-2013-1813.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://rhn.redhat.com/errata/RHSA-2013-1815.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://rhn.redhat.com/errata/RHSA-2013-1824.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://rhn.redhat.com/errata/RHSA-2013-1825.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://rhn.redhat.com/errata/RHSA-2013-1826.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://secunia.com/advisories/59652",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://support.apple.com/kb/HT6150",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.debian.org/security/2013/dsa-2816",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.php.net/ChangeLog-5.php",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.securityfocus.com/bid/64225",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.securitytracker.com/id/1029472",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.ubuntu.com/usn/USN-2055-1",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=1036830",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04463322",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04463322",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Exploit",
         ],
         url: "https://www.sektioneins.de/advisories/advisory-012013-php-openssl_x509_parse-memory-corruption-vulnerability.html",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-119",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.