7.5

CVE-2013-3735

Exploit

The Zend Engine in PHP before 5.4.16 RC1, and 5.5.0 before RC2, does not properly determine whether a parser error occurred, which allows context-dependent attackers to cause a denial of service (memory consumption and application crash) via a crafted function definition, as demonstrated by an attack within a shared web-hosting environment.  NOTE: the vendor's http://php.net/security-note.php page says "for critical security situations you should be using OS-level security by running multiple web servers each as their own user id.

Data is provided by the National Vulnerability Database (NVD)
Php ≫ Php Updaterc1 Version <= 5.4.15
Php ≫ Php Version5.4.0
Php ≫ Php Version5.4.1
Php ≫ Php Version5.4.2
Php ≫ Php Version5.4.3
Php ≫ Php Version5.4.4
Php ≫ Php Version5.4.5
Php ≫ Php Version5.4.6
Php ≫ Php Version5.4.7
Php ≫ Php Version5.4.8
Php ≫ Php Version5.4.9
Php ≫ Php Version5.4.10
Php ≫ Php Version5.4.11
Php ≫ Php Version5.4.12
Php ≫ Php Version5.4.12 Updaterc1
Php ≫ Php Version5.4.12 Updaterc2
Php ≫ Php Version5.4.13
Php ≫ Php Version5.4.13 Updaterc1
Php ≫ Php Version5.4.14
Php ≫ Php Version5.4.14 Updaterc1
Php ≫ Php Updaterc1 Version <= 5.5.0
Php ≫ Php Version5.5.0 Updatealpha1
Php ≫ Php Version5.5.0 Updatealpha2
Php ≫ Php Version5.5.0 Updatealpha3
Php ≫ Php Version5.5.0 Updatealpha4
Php ≫ Php Version5.5.0 Updatealpha5
Php ≫ Php Version5.5.0 Updatealpha6
Php ≫ Php Version5.5.0 Updatebeta1
Php ≫ Php Version5.5.0 Updatebeta2
Php ≫ Php Version5.5.0 Updatebeta3
Php ≫ Php Version5.5.0 Updatebeta4
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.68% 0.708
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
134c704f-9b21-4f2e-91b3-4a467353bcc0 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.