CVE-2011-1657

PHP 5.3.6 - Denial of Service via ZipArchive addGlob/addPattern Flags

Title source: llm
STIX 2.1

Description

The (1) ZipArchive::addGlob and (2) ZipArchive::addPattern functions in ext/zip/php_zip.c in PHP 5.3.6 allow context-dependent attackers to cause a denial of service (application crash) via certain flags arguments, as demonstrated by (a) GLOB_ALTDIRFUNC and (b) GLOB_APPEND.

References (14)

Core 14
Core References
Patch mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2011/07/01/6
Exploit x_refsource_confirm
https://bugs.php.net/bug.php?id=54681
Vendor Advisory x_refsource_confirm
http://support.apple.com/kb/HT5130
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2011:165
Mailing List vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html
Exploit third-party-advisory x_refsource_sreasonres
http://securityreason.com/achievement_securityalert/100
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/49252
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2011/07/01/7
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2011/07/01/8
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/8342
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/519385/100/0/threaded
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/69320

Scores

EPSS 0.1067
EPSS Percentile 93.4%

Details

CWE
CWE-399
Status published
Products (1)
php/php 5.3.6
Published Aug 25, 2011
Tracked Since Feb 18, 2026