CVE-2012-0789

PHP <5.3.9 - DoS

Title source: llm

Description

Memory leak in the timezone functionality in PHP before 5.3.9 allows remote attackers to cause a denial of service (memory consumption) by triggering many strtotime function calls, which are not properly handled by the php_date_parse_tzfile cache.

Exploits (1)

exploitdb WORKING POC VERIFIED

by anonymous · phpdosphp

https://www.exploit-db.com/exploits/36789

View Code ZIP pw:eip

References (6)

[Mailing List] http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00013.html

[Mailing List] http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00016.html

[Third Party Advisory] http://secunia.com/advisories/48668

[Vendor Advisory] http://www.php.net/ChangeLog-5.php#5.3.9

[Exploit] https://bugs.php.net/bug.php?id=53502

[Exploit] https://bugzilla.redhat.com/show_bug.cgi?id=783609

Scores

EPSS 0.0779

EPSS Percentile 92.0%

Details

CWE

CWE-399

Status published

Products (38)

php/php 5.0.0 (8 CPE variants)

php/php 5.0.1

php/php 5.0.2

php/php 5.0.3

php/php 5.0.4

php/php 5.0.5

php/php 5.1.1

php/php 5.1.2

php/php 5.1.3

php/php 5.1.4

... and 28 more

Published Feb 14, 2012

Tracked Since Feb 18, 2026