Stack-based buffer overflow in the date_from_ISO8601 function in ext/xmlrpc/libxmlrpc/xmlrpc.c in PHP before 5.2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by including a timezone field in a date, leading to improper XML-RPC encoding.
CVSS Details
- CVSS 3.1 Base Score: 7.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade php-commonUpgrade php-soapUpgrade php-ldapUpgrade php-pdoUpgrade php-ncursesUpgrade php-pgsqlUpgrade php-odbcUpgrade php-bcmathUpgrade php-dbaUpgrade php-gdUpgrade php-snmpUpgrade php-xmlUpgrade php-mysqlUpgrade php-xmlrpcUpgrade php-imapUpgrade phpUpgrade php-cliUpgrade php-develUpgrade php-mbstring | Dec 1, 2016 | Nov 22, 2014 |
| Oracle_linux | — | Upgrade php-ncursesUpgrade php-xmlrpcUpgrade php-pgsqlUpgrade php-gdUpgrade php-soapUpgrade php-bcmathUpgrade phpUpgrade php-pdoUpgrade php-develUpgrade php-ldapUpgrade php-dbaUpgrade php-cliUpgrade php-imapUpgrade php-odbcUpgrade php-commonUpgrade php-xmlUpgrade php-mysqlUpgrade php-snmpUpgrade php-mbstring | Oct 16, 2024 | Nov 23, 2014 |
| Php | — | Upgrade to PHP version 5.2.7 | Dec 1, 2014 | Nov 22, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub