CVE-2013-6420

Php < 10.9.1 - Memory Corruption

Title source: rule
STIX 2.1

Description

The asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse (1) notBefore and (2) notAfter timestamps in X.509 certificates, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted certificate that is not properly handled by the openssl_x509_parse function.

Exploits (1)

exploitdb WRITEUP
by Stefan Esser · textdosphp
https://www.exploit-db.com/exploits/30395

References (19)

Core 19
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2013-1824.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2013-1826.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2013-1815.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2013-1813.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2013-1825.html
Various Sources vendor-advisory x_refsource_hp
https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04463322
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2013/dsa-2816
Mailing List vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2013-12/msg00126.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/59652
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/64225
Vendor Advisory x_refsource_confirm
http://support.apple.com/kb/HT6150
Vendor Advisory x_refsource_confirm
http://www.php.net/ChangeLog-5.php
Mailing List vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2013-12/msg00125.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1029472
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2055-1

Scores

EPSS 0.4022
EPSS Percentile 97.4%

Details

CWE
CWE-119
Status published
Products (44)
apple/mac_os_x < 10.9.1
opensuse/opensuse 11.4
opensuse/opensuse 12.2
opensuse/opensuse 12.3
opensuse/opensuse 13.1
php/php 5.4.0
php/php 5.4.1
php/php 5.4.2
php/php 5.4.3
php/php 5.4.4
... and 34 more
Published Dec 17, 2013
Tracked Since Feb 18, 2026