6.4

CVE-2010-1128

Exploit
The Linear Congruential Generator (LCG) in PHP before 5.2.13 does not provide the expected entropy, which makes it easier for context-dependent attackers to guess values that were intended to be unpredictable, as demonstrated by session cookies generated by using the uniqid function.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Php ≫ Php Version <= 5.2.12
Php ≫ Php Version5.2.0
Php ≫ Php Version5.2.1
Php ≫ Php Version5.2.2
Php ≫ Php Version5.2.3
Php ≫ Php Version5.2.4
Php ≫ Php Version5.2.5
Php ≫ Php Version5.2.6
Php ≫ Php Version5.2.7
Php ≫ Php Version5.2.8
Php ≫ Php Version5.2.9
Php ≫ Php Version5.2.10
Php ≫ Php Version5.2.11
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 7.94% 0.94
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.4 10 4.9
AV:N/AC:L/Au:N/C:P/I:P/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://www.php.net/ChangeLog-5.php
http://secunia.com/advisories/42410
http://www.redhat.com/support/errata/RHSA-2010-0919.html
http://www.vupen.com/english/advisories/2010/3081
http://secunia.com/advisories/38708
Vendor Advisory
http://www.php.net/releases/5_2_13.php
Vendor Advisory
http://www.securityfocus.com/bid/38430
Exploit
http://www.vupen.com/english/advisories/2010/0479
Patch
Vendor Advisory