CVE-2010-1914
Published: 12 May 2010
The Zend Engine in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information by interrupting the handler for the (1) ZEND_BW_XOR opcode (shift_left_function), (2) ZEND_SL opcode (bitwise_xor_function), or (3) ZEND_SR opcode (shift_right_function), related to the convert_to_long_base function.
Notes
| Author | Note |
|---|---|
| mdeslaur | interruption issue, safe_mode - open_basedir bypass, ignoring This is MOPS-2010-014, MOPS-2010-015, MOPS-2010-016 |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
php5 Launchpad, Ubuntu, Debian |
dapper |
Ignored
|
| hardy |
Ignored
|
|
| jaunty |
Ignored
|
|
| karmic |
Ignored
|
|
| lucid |
Released
(5.3.2-1ubuntu4.10)
|
|
| maverick |
Not vulnerable
(5.3.3-1ubuntu6)
|
|
| natty |
Not vulnerable
(5.3.3-1ubuntu6)
|
|
| oneiric |
Not vulnerable
(5.3.3-1ubuntu6)
|
|
| upstream |
Released
(5.3.3)
|
|
|
Patches: upstream: http://svn.php.net/viewvc?view=revision&revision=299280 |
||
References
- http://www.php-security.org/2010/05/08/mops-2010-014-php-zend_bw_xor-opcode-interruption-address-information-leak-vulnerability/index.html
- http://www.php-security.org/2010/05/08/mops-2010-015-php-zend_sl-opcode-interruption-address-information-leak-vulnerability/index.html
- http://www.php-security.org/2010/05/08/mops-2010-016-php-zend_sr-opcode-interruption-address-information-leak-vulnerability/index.html
- http://www.php.net/releases/5_3_3.php
- https://ubuntu.com/security/notices/USN-1231-1
- https://www.cve.org/CVERecord?id=CVE-2010-1914
- NVD
- Launchpad
- Debian