Format string vulnerability in stream.c in the phar extension in PHP 5.3.x through 5.3.3 allows context-dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code via a crafted phar:// URI that is not properly handled by the phar_stream_flush function, leading to errors in the php_stream_wrapper_log_error function. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-2094.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Airport | — | Apply OS X security update 2011-001Upgrade macOS to the latest versionApply OS X security update 2011-004 | Aug 28, 2015 | Sep 28, 2010 |
| Apple Osx Php | — | Upgrade macOS to the latest version | Dec 16, 2011 | Sep 28, 2010 |
| Centos_linux | — | Upgrade php-xmlUpgrade php53-imapUpgrade php53-mysqlUpgrade php-commonUpgrade php53-odbcUpgrade php-xmlrpcUpgrade php53-develUpgrade php53-commonUpgrade php-mbstringUpgrade php-recodeUpgrade php-cliUpgrade php53-mbstringUpgrade php53Upgrade php53-pdoUpgrade php-snmpUpgrade php-ztsUpgrade php53-gdUpgrade php-mysqlUpgrade php-bcmathUpgrade php-embeddedUpgrade php-pdoUpgrade php53-soapUpgrade php53-pgsqlUpgrade php-develUpgrade php-ldapUpgrade phpUpgrade php53-xmlUpgrade php53-processUpgrade php-enchantUpgrade php53-snmpUpgrade php53-xmlrpcUpgrade php-tidyUpgrade php-gdUpgrade php-odbcUpgrade php53-dbaUpgrade php53-cliUpgrade php53-ldapUpgrade php-processUpgrade php-pgsqlUpgrade php-soapUpgrade php53-pspellUpgrade php53-intlUpgrade php-pspellUpgrade php-dbaUpgrade php53-bcmathUpgrade php-intlUpgrade php-imap | Dec 1, 2016 | Sep 28, 2010 |
| Gentoo Linux | — | Upgrade dev-lang/php. | Oct 30, 2017 | Sep 28, 2010 |
| Hpsmh | — | Upgrade to the latest version of HP System Management Homepage | Oct 13, 2015 | Sep 28, 2010 |
| Oracle_linux | — | Upgrade php-mysqlUpgrade php53-xmlrpcUpgrade php53-develUpgrade php-pspellUpgrade php-snmpUpgrade php53-snmpUpgrade php53-dbaUpgrade php-cliUpgrade php-processUpgrade php53-ldapUpgrade php53-pspellUpgrade php53-bcmathUpgrade php-dbaUpgrade php-mbstringUpgrade php53-intlUpgrade php53-cliUpgrade php53-processUpgrade php-imapUpgrade php-intlUpgrade php-commonUpgrade php53-mysqlUpgrade php-recodeUpgrade php-xmlrpcUpgrade php-tidyUpgrade php53-mbstringUpgrade phpUpgrade php-odbcUpgrade php53-xmlUpgrade php-gdUpgrade php-ldapUpgrade php-xmlUpgrade php53-pgsqlUpgrade php-pdoUpgrade php-ztsUpgrade php53-commonUpgrade php-pgsqlUpgrade php-embeddedUpgrade php53-odbcUpgrade php53-soapUpgrade php-bcmathUpgrade php-soapUpgrade php53Upgrade php-develUpgrade php53-gdUpgrade php-enchantUpgrade php53-imapUpgrade php53-pdo | Oct 16, 2024 | Sep 28, 2010 |
| Php | — | Upgrade to PHP version 5.3.4 | Oct 1, 2012 | Sep 28, 2010 |
| Suse | — | Upgrade php53-pearUpgrade php8-pdoUpgrade php53-suhosinUpgrade php5-develUpgrade php53-bcmathUpgrade php53-tokenizerUpgrade php53-pgsqlUpgrade php7-tokenizerUpgrade php53-tidyUpgrade php53-mbstringUpgrade php53-gettextUpgrade php7-pdoUpgrade php8-mysqlUpgrade php8-curlUpgrade php8-ldapUpgrade apache2-mod_php53Upgrade php8-domUpgrade php8-sqliteUpgrade php8-fpmUpgrade php53-pcntlUpgrade php53-exifUpgrade php53-readlineUpgrade php53-opensslUpgrade php53-sysvmsgUpgrade php8-sysvmsgUpgrade php53-shmopUpgrade php53-develUpgrade php53-xmlwriterUpgrade php53-gdUpgrade php8-embedUpgrade php7-develUpgrade php72-develUpgrade php8-gmpUpgrade php8Upgrade php53Upgrade php7-xmlreaderUpgrade php7-mysqlUpgrade php7-iconvUpgrade php53-curlUpgrade php8-tokenizerUpgrade php8-tidyUpgrade php8-iconvUpgrade php53-xmlrpcUpgrade php53-imapUpgrade php8-dbaUpgrade php53-dbaUpgrade php7-sqliteUpgrade php53-zipUpgrade php8-fastcgiUpgrade php8-odbcUpgrade php53-mysqlUpgrade php8-shmopUpgrade php53-iconvUpgrade php53-socketsUpgrade php53-fastcgiUpgrade php8-gettextUpgrade php53-xmlreaderUpgrade php7Upgrade php7-xmlwriterUpgrade php8-socketsUpgrade php53-bz2Upgrade php7-pgsqlUpgrade php8-readlineUpgrade php53-pdoUpgrade php53-pspellUpgrade php53-odbcUpgrade php7-domUpgrade php8-ftpUpgrade php8-xmlwriterUpgrade php8-fileinfoUpgrade php53-posixUpgrade php53-gmpUpgrade php8-pcntlUpgrade php53-wddxUpgrade php53-ftpUpgrade php8-cliUpgrade php53-ctypeUpgrade php8-pharUpgrade php53-soapUpgrade php8-xmlreaderUpgrade php8-fpm-apacheUpgrade php8-zipUpgrade php8-bz2Upgrade php53-mcryptUpgrade php8-calendarUpgrade php53-fileinfoUpgrade php7-ctypeUpgrade php53-intlUpgrade php7-jsonUpgrade php53-ldapUpgrade php53-domUpgrade php8-sysvsemUpgrade apache2-mod_php7Upgrade php8-mbstringUpgrade php53-jsonUpgrade apache2-mod_php8Upgrade php53-snmpUpgrade php53-sysvshmUpgrade php8-sysvshmUpgrade php8-xslUpgrade php8-snmpUpgrade php53-calendarUpgrade php53-sqliteUpgrade php8-ffiUpgrade php53-zlibUpgrade php8-exifUpgrade php8-pgsqlUpgrade php8-bcmathUpgrade php8-gdUpgrade php53-sysvsemUpgrade php8-ctypeUpgrade php8-opensslUpgrade php8-zlibUpgrade php8-intlUpgrade php53-xslUpgrade php8-soapUpgrade php8-sodiumUpgrade php8-opcacheUpgrade php8-enchantUpgrade php8-posixUpgrade php8-devel | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade php5-cliUpgrade libapache2-mod-php5Upgrade php5-cgi | Nov 8, 2024 | Sep 28, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub