CVE-2010-3709

PHP 5.2.0-5.2.14 and 5.3.0-5.3.3 - Denial of Service via ZipArchive::getArchiveComment

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2010-3709. PoCs published by Maksymilian Arciemowicz.

AI-analyzed exploit summary This exploit demonstrates a NULL pointer dereference vulnerability in PHP's ZipArchive::getArchiveComment() function, leading to a segmentation fault when processing an empty ZIP file. The issue arises due to improper handling of NULL return values from zip_get_archive_comment().

Description

The ZipArchive::getArchiveComment function in PHP 5.2.x through 5.2.14 and 5.3.x through 5.3.3 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ZIP archive.

Exploits (1)

exploitdb WORKING POC

by Maksymilian Arciemowicz · textdosphp

https://www.exploit-db.com/exploits/15431

View Code ZIP pw:eip

This exploit demonstrates a NULL pointer dereference vulnerability in PHP's ZipArchive::getArchiveComment() function, leading to a segmentation fault when processing an empty ZIP file. The issue arises due to improper handling of NULL return values from zip_get_archive_comment().

Classification

Working Poc 100%

Attack Type

Dos

Complexity

Trivial

Reliability

Reliable

Target: PHP 5.3.3, PHP 5.2.14

No auth needed

Prerequisites: An empty ZIP file

MITRE ATT&CK

T1499 - Endpoint Denial of Service

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (26)

Core 26

Core References

Permissions Required vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2011/0077

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052836.html

Broken Link third-party-advisory x_refsource_secunia

http://secunia.com/advisories/42812

Mailing List, Third Party Advisory vendor-advisory x_refsource_hp

http://marc.info/?l=bugtraq&m=133469208622507&w=2

Mailing List, Third Party Advisory vendor-advisory x_refsource_hp

http://marc.info/?l=bugtraq&m=130331363227777&w=2

Broken Link vendor-advisory x_refsource_mandriva

http://www.mandriva.com/security/advisories?name=MDVSA-2010:218

Third Party Advisory third-party-advisory x_refsource_sreasonres

http://securityreason.com/achievement_securityalert/90

Third Party Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2011-0195.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id?1024690

Vendor Advisory x_refsource_confirm

http://www.php.net/releases/5_3_4.php

Patch, Vendor Advisory x_refsource_confirm

http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/ext/zip/php_zip.c?view=log

Mailing List, Third Party Advisory vendor-advisory x_refsource_apple

http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html

Third Party Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-1042-1

Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db

http://www.exploit-db.com/exploits/15431

Permissions Required vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2011/0021

Vendor Advisory x_refsource_confirm

http://www.php.net/ChangeLog-5.php

Third Party Advisory vendor-advisory x_refsource_slackware

http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.490619

Permissions Required vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2010/3313

Vendor Advisory x_refsource_confirm

http://www.php.net/archive/2010.php#id2010-12-10-1

Vendor Advisory x_refsource_confirm

http://www.php.net/releases/5_2_15.php

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052845.html

Patch, Vendor Advisory x_refsource_confirm

http://svn.php.net/viewvc/php/php-src/branches/PHP_5_2/ext/zip/php_zip.c?view=log

Permissions Required vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2011/0020

Broken Link third-party-advisory x_refsource_secunia

http://secunia.com/advisories/42729

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/44718

Third Party Advisory x_refsource_confirm

http://support.apple.com/kb/HT4581

Scores

EPSS 0.1333

EPSS Percentile 95.9%

Details

CWE

CWE-20

Status published

Products (6)

canonical/ubuntu_linux 6.06

canonical/ubuntu_linux 8.04

canonical/ubuntu_linux 9.10

canonical/ubuntu_linux 10.04

canonical/ubuntu_linux 10.10

php/php 5.2.0 - 5.2.15

Published Nov 09, 2010

Tracked Since Feb 18, 2026