The is_a function in PHP 5.3.7 and 5.3.8 triggers a call to the __autoload function, which makes it easier for remote attackers to execute arbitrary code by providing a crafted URL and leveraging potentially unsafe behavior in certain PEAR packages and custom autoloaders.
CVSS Details
- CVSS 3.1 Base Score: 7.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Gentoo Linux | — | Upgrade dev-lang/php. | Oct 30, 2017 | Nov 3, 2011 |
| Hpsmh | — | Upgrade to the latest version of HP System Management Homepage | Oct 13, 2015 | Nov 3, 2011 |
| Php | — | Upgrade to PHP version 5.3.9 | Oct 1, 2012 | Nov 3, 2011 |
| Suse | — | Upgrade php7-xmlwriterUpgrade php7-tokenizerUpgrade php53-xmlwriterUpgrade php8-pgsqlUpgrade php53-sysvmsgUpgrade php53-develUpgrade php53-imapUpgrade php53-pgsqlUpgrade php53-mcryptUpgrade php7-iconvUpgrade php7-pdoUpgrade php8-exifUpgrade php53-fileinfoUpgrade php53-calendarUpgrade php53-posixUpgrade php7-sqliteUpgrade php8-sqliteUpgrade php53-mysqlUpgrade php53-mbstringUpgrade php53-gettextUpgrade php8-tidyUpgrade php53-xmlreaderUpgrade php8-shmopUpgrade php53-soapUpgrade php53-suhosinUpgrade php53-sysvsemUpgrade php53-odbcUpgrade apache2-mod_php53Upgrade php53-iconvUpgrade php8-fastcgiUpgrade php7-jsonUpgrade php8-gettextUpgrade php8-posixUpgrade php8-iconvUpgrade php53-curlUpgrade php8-xmlreaderUpgrade php8-gmpUpgrade php8-fpmUpgrade apache2-mod_php8Upgrade php53-wddxUpgrade php7-pgsqlUpgrade php53-shmopUpgrade php8-curlUpgrade php8-fileinfoUpgrade php8-ftpUpgrade php8-sysvsemUpgrade php8Upgrade apache2-mod_php7Upgrade php53-ftpUpgrade php7-develUpgrade php53-socketsUpgrade php53-zipUpgrade php7-domUpgrade php8-pharUpgrade php8-pcntlUpgrade php8-snmpUpgrade php8-sodiumUpgrade php53-tidyUpgrade php53-sqliteUpgrade php8-mbstringUpgrade php8-sysvshmUpgrade php7Upgrade php8-ldapUpgrade php8-odbcUpgrade php5-develUpgrade php53-gdUpgrade php8-gdUpgrade php8-opensslUpgrade php53-ctypeUpgrade php8-bz2Upgrade php53-exifUpgrade php53-readlineUpgrade php8-socketsUpgrade php53-pdoUpgrade php53-domUpgrade php8-zipUpgrade php53-intlUpgrade php8-xslUpgrade php72-develUpgrade php8-bcmathUpgrade php8-dbaUpgrade php8-cliUpgrade php53-pearUpgrade php8-domUpgrade php53-gmpUpgrade php8-readlineUpgrade php53-opensslUpgrade php8-enchantUpgrade php53-jsonUpgrade php53-zlibUpgrade php8-zlibUpgrade php8-opcacheUpgrade php8-calendarUpgrade php53-pspellUpgrade php8-ffiUpgrade php53-sysvshmUpgrade php53-snmpUpgrade php7-ctypeUpgrade php8-fpm-apacheUpgrade php8-soapUpgrade php8-tokenizerUpgrade php8-develUpgrade php53-bcmathUpgrade php53-xmlrpcUpgrade php8-mysqlUpgrade php53-pcntlUpgrade php53-dbaUpgrade php8-intlUpgrade php7-xmlreaderUpgrade php8-embedUpgrade php53-tokenizerUpgrade php8-ctypeUpgrade php7-mysqlUpgrade php53-fastcgiUpgrade php53-ldapUpgrade php8-pdoUpgrade php8-xmlwriterUpgrade php53-bz2Upgrade php53Upgrade php53-xslUpgrade php8-sysvmsg | Aug 9, 2024 | Jul 9, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub