Exploitation Summary
EIP tracks 1 public exploit for CVE-2012-2386. PoCs published by Alexander Gavrun.
AI-analyzed exploit summary This exploit leverages an integer overflow vulnerability in PHP's phar extension (CVE-2012-2386), leading to a heap overflow. The PoC demonstrates how a maliciously crafted tar file can trigger the vulnerability by manipulating the uncompressed file size field.
Description
Integer overflow in the phar_parse_tarfile function in tar.c in the phar extension in PHP before 5.3.14 and 5.4.x before 5.4.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted tar file that triggers a heap-based buffer overflow.
Exploits (1)
This exploit leverages an integer overflow vulnerability in PHP's phar extension (CVE-2012-2386), leading to a heap overflow. The PoC demonstrates how a maliciously crafted tar file can trigger the vulnerability by manipulating the uncompressed file size field.