Format string vulnerability in stream.c in the phar extension in PHP 5.3.x through 5.3.3 allows context-dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code via a crafted phar:// URI that is not properly handled by the phar_stream_flush function, leading to errors in the php_stream_wrapper_log_error function. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-2094.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Airport | — | Upgrade macOS to the latest versionApply OS X security update 2011-001Apply OS X security update 2011-004 | Aug 28, 2015 | Sep 28, 2010 |
| Apple Osx Php | — | Upgrade macOS to the latest version | Dec 16, 2011 | Sep 28, 2010 |
| Centos_linux | — | Upgrade php-xmlrpcUpgrade php-ldapUpgrade php-bcmathUpgrade php-xmlUpgrade php-develUpgrade php53-gdUpgrade php53-imapUpgrade php53-mysqlUpgrade php-recodeUpgrade php53-pgsqlUpgrade php53-odbcUpgrade php-cliUpgrade php53Upgrade php-commonUpgrade php53-commonUpgrade php53-pdoUpgrade php-embeddedUpgrade php-mbstringUpgrade php-pdoUpgrade php53-soapUpgrade php-ztsUpgrade php53-develUpgrade php-mysqlUpgrade php53-mbstringUpgrade php-snmpUpgrade php53-cliUpgrade php-gdUpgrade php-imapUpgrade php-processUpgrade php53-xmlrpcUpgrade php53-intlUpgrade php53-processUpgrade phpUpgrade php-tidyUpgrade php-pgsqlUpgrade php53-ldapUpgrade php53-snmpUpgrade php-intlUpgrade php-odbcUpgrade php-dbaUpgrade php53-xmlUpgrade php53-bcmathUpgrade php53-dbaUpgrade php-soapUpgrade php53-pspellUpgrade php-pspellUpgrade php-enchant | Dec 1, 2016 | Sep 28, 2010 |
| Gentoo Linux | — | Upgrade dev-lang/php. | Oct 30, 2017 | Sep 28, 2010 |
| Hpsmh | — | Upgrade to the latest version of HP System Management Homepage | Oct 13, 2015 | Sep 28, 2010 |
| Oracle_linux | — | Upgrade php53-bcmathUpgrade php-cliUpgrade php-dbaUpgrade php53-snmpUpgrade php-xmlrpcUpgrade php-recodeUpgrade php53-xmlrpcUpgrade php-mbstringUpgrade php53-intlUpgrade php53-develUpgrade php-commonUpgrade php53-pspellUpgrade php-imapUpgrade php-snmpUpgrade php53-dbaUpgrade php-mysqlUpgrade php53-processUpgrade php-pspellUpgrade php-processUpgrade php53-cliUpgrade php-intlUpgrade php53-ldapUpgrade php53-mysqlUpgrade php-tidyUpgrade php-odbcUpgrade php53-xmlUpgrade php-xmlUpgrade php53-pgsqlUpgrade php53-pdoUpgrade php53Upgrade php-ztsUpgrade php53-commonUpgrade php53-gdUpgrade phpUpgrade php53-soapUpgrade php53-mbstringUpgrade php-develUpgrade php-pgsqlUpgrade php-embeddedUpgrade php53-odbcUpgrade php-bcmathUpgrade php-pdoUpgrade php-enchantUpgrade php-gdUpgrade php-ldapUpgrade php53-imapUpgrade php-soap | Oct 16, 2024 | Sep 28, 2010 |
| Php | — | Upgrade to PHP version 5.3.4 | Oct 1, 2012 | Sep 28, 2010 |
| Suse | — | Upgrade php8-sysvshmUpgrade php8-develUpgrade php53-intlUpgrade php53-sqliteUpgrade php8-opcacheUpgrade php53-domUpgrade php8-fpm-apacheUpgrade php53-soapUpgrade php53-jsonUpgrade php7-ctypeUpgrade php8-ctypeUpgrade php53-xslUpgrade apache2-mod_php8Upgrade php8-gdUpgrade php8-mbstringUpgrade php8-xmlreaderUpgrade php8-pharUpgrade php8-calendarUpgrade php8-pgsqlUpgrade php8-xslUpgrade php53-calendarUpgrade apache2-mod_php7Upgrade php8-intlUpgrade php53-zlibUpgrade php53-fileinfoUpgrade php8-soapUpgrade php8-cliUpgrade php8-exifUpgrade php53-sysvshmUpgrade php53-ctypeUpgrade php8-zipUpgrade php8-sysvsemUpgrade php53-mcryptUpgrade php8-posixUpgrade php53-ldapUpgrade php8-sodiumUpgrade php8-bz2Upgrade php8-bcmathUpgrade php8-snmpUpgrade php7-jsonUpgrade php53-snmpUpgrade php8-zlibUpgrade php53-sysvsemUpgrade php8-opensslUpgrade php8-ffiUpgrade php8-enchantUpgrade php53-shmopUpgrade php53-wddxUpgrade php8-xmlwriterUpgrade php7-xmlwriterUpgrade php7-domUpgrade php8-embedUpgrade php53Upgrade php7-pgsqlUpgrade php8-ldapUpgrade php53-sysvmsgUpgrade php8-gettextUpgrade php7Upgrade php8Upgrade php53-curlUpgrade php8-tidyUpgrade php7-xmlreaderUpgrade php53-fastcgiUpgrade php53-dbaUpgrade php53-suhosinUpgrade php53-socketsUpgrade php7-pdoUpgrade php8-tokenizerUpgrade php8-iconvUpgrade php8-readlineUpgrade php53-imapUpgrade php53-gmpUpgrade php8-odbcUpgrade php5-develUpgrade php8-mysqlUpgrade php8-fileinfoUpgrade php72-develUpgrade php53-gettextUpgrade php53-odbcUpgrade php53-opensslUpgrade php8-shmopUpgrade php8-pdoUpgrade php53-pdoUpgrade php8-fpmUpgrade php7-tokenizerUpgrade php8-ftpUpgrade php8-fastcgiUpgrade php53-tokenizerUpgrade php8-pcntlUpgrade php53-bz2Upgrade php8-sqliteUpgrade php53-zipUpgrade php53-pcntlUpgrade php53-iconvUpgrade php53-develUpgrade php7-develUpgrade apache2-mod_php53Upgrade php8-domUpgrade php7-sqliteUpgrade php53-posixUpgrade php53-pgsqlUpgrade php8-socketsUpgrade php8-sysvmsgUpgrade php8-dbaUpgrade php53-pearUpgrade php53-mysqlUpgrade php53-pspellUpgrade php53-gdUpgrade php53-bcmathUpgrade php53-exifUpgrade php53-xmlrpcUpgrade php8-curlUpgrade php8-gmpUpgrade php53-tidyUpgrade php53-readlineUpgrade php7-iconvUpgrade php53-ftpUpgrade php7-mysqlUpgrade php53-xmlreaderUpgrade php53-mbstringUpgrade php53-xmlwriter | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade php5-cgiUpgrade libapache2-mod-php5Upgrade php5-cli | Nov 8, 2024 | Sep 28, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub