Fluid Attacks Database

Description

ext/xml/xml.c in PHP before 5.3.27 does not properly consider parsing depth, which allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted document that is processed by the xml_parse_into_struct function.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
rpm rhel5	php	<0:5.1.6-40.el5_9	0:5.1.6-40.el5_9
rpm rhel6	php	<0:5.3.3-23.el6_4	0:5.3.3-23.el6_4
rpm rhel5	php53	<0:5.3.3-13.el5_9.1	0:5.3.3-13.el5_9.1

Aliases

1. CVE-2013-41132. NVD-2013-41133. OSV-2013-4113

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.