Fluid Attacks Database

Description

The asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse (1) notBefore and (2) notAfter timestamps in X.509 certificates, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted certificate that is not properly handled by the openssl_x509_parse function.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
rpm rhel5	php	<0:5.1.6-43.el5_10	0:5.1.6-43.el5_10
rpm rhel5.9	php	<0:5.1.6-40.el5_9.1	0:5.1.6-40.el5_9.1
rpm rhel6	php	<0:5.3.3-27.el6_5	0:5.3.3-27.el6_5
rpm rhel6.4	php	<0:5.3.3-23.el6_4.1	0:5.3.3-23.el6_4.1
rpm rhel5	php53	<0:5.3.3-22.el5_10	0:5.3.3-22.el5_10
rpm rhel5.9	php53	<0:5.3.3-13.el5_9.2	0:5.3.3-13.el5_9.2

Aliases

1. CVE-2013-64202. NVD-2013-64203. OSV-2013-6420

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.