CVE-2011-3182

PHP < 5.3.7 - Denial of Service via Malloc Return Value Mismanagement

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2011-3182. PoCs published by Maksymilian Arciemowicz.

AI-analyzed exploit summary This exploit demonstrates a NULL-pointer dereference vulnerability in PHP's strtotime function, leading to a segmentation fault and denial-of-service when processing a large string input. The PoC includes a PHP script and GDB debugging output confirming the crash.

Description

PHP before 5.3.7 does not properly check the return values of the malloc, calloc, and realloc library functions, which allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger a buffer overflow by leveraging the ability to provide an arbitrary value for a function argument, related to (1) ext/curl/interface.c, (2) ext/date/lib/parse_date.c, (3) ext/date/lib/parse_iso_intervals.c, (4) ext/date/lib/parse_tz.c, (5) ext/date/lib/timelib.c, (6) ext/pdo_odbc/pdo_odbc.c, (7) ext/reflection/php_reflection.c, (8) ext/soap/php_sdl.c, (9) ext/xmlrpc/libxmlrpc/base64.c, (10) TSRM/tsrm_win32.c, and (11) the strtotime function.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Maksymilian Arciemowicz · textdosphp
https://www.exploit-db.com/exploits/36070

This exploit demonstrates a NULL-pointer dereference vulnerability in PHP's strtotime function, leading to a segmentation fault and denial-of-service when processing a large string input. The PoC includes a PHP script and GDB debugging output confirming the crash.

Classification
Working Poc 90%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: PHP 5.3.7
No auth needed
Prerequisites: Ability to execute PHP code with a large input string
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (8)

Core 8
Core References
Vendor Advisory x_refsource_confirm
http://support.apple.com/kb/HT5130
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2011:165
Mailing List vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/69430
Exploit third-party-advisory x_refsource_sreasonres
http://securityreason.com/achievement_securityalert/101
Exploit mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2011/08/22/9
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/49249
Exploit mailing-list x_refsource_fulldisc
http://marc.info/?l=full-disclosure&m=131373057621672&w=2

Scores

EPSS 0.1914
EPSS Percentile 97.0%

Details

Status published
Products (46)
php/php 1.0
php/php 2.0
php/php 2.0b10
php/php 3.0
php/php 3.0.1
php/php 3.0.2
php/php 3.0.3
php/php 3.0.4
php/php 3.0.5
php/php 3.0.6
... and 36 more
Published Aug 25, 2011
Tracked Since Feb 18, 2026