Fluid Attacks Database

Description

The SOAP parser in PHP before 5.3.23 and 5.4.x before 5.4.13 allows remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue in the soap_xmlParseFile and soap_xmlParseMemory functions. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-1824.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
rpm rhel6	php	<0:5.3.3-26.el6	0:5.3.3-26.el6
rpm rhel5	php	<0:5.1.6-43.el5_10	0:5.1.6-43.el5_10
rpm rhel5	php53	<0:5.3.3-21.el5	0:5.3.3-21.el5

Aliases

1. CVE-2013-16432. NVD-2013-16433. OSV-2013-1643

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.