#VU43164 Information disclosure in PHP - CVE-2012-6113


| Updated: 2020-08-11

Vulnerability identifier: #VU43164

Vulnerability risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2012-6113

CWE-ID: CWE-200

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
PHP
Universal components / Libraries / Scripting languages

Vendor: PHP Group

Description

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The openssl_encrypt function in ext/openssl/openssl.c in PHP 5.3.9 through 5.3.13 does not initialize a certain variable, which allows remote attackers to obtain sensitive information from process memory by providing zero bytes of input data.

Mitigation
Install update from vendor's website.

Vulnerable software versions

PHP: 5.3.9 - 5.3.13

External links
https://git.php.net/?p=php-src.git;a=commit;h=270a406ac94b5fc5cc9ef59fc61e3b4b95648a3e
https://openwall.com/lists/oss-security/2013/01/18/6
https://www.ubuntu.com/usn/USN-1702-1
https://bugs.launchpad.net/ubuntu/+source/php5/+bug/1099793
https://bugs.php.net/bug.php?id=61413

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.


Latest bulletins with this vulnerability


Information disclosure in PHP