Memory leak in the timezone functionality in PHP before 5.3.9 allows remote attackers to cause a denial of service (memory consumption) by triggering many strtotime function calls, which are not properly handled by the php_date_parse_tzfile cache.
CVSS Details
- CVSS 3.1 Base Score: 9.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade php53-gdUpgrade php53-xmlUpgrade php-enchantUpgrade php-embeddedUpgrade php-pdoUpgrade php-dbaUpgrade php-intlUpgrade php-develUpgrade php53-snmpUpgrade php-ldapUpgrade php-tidyUpgrade php53Upgrade php-ztsUpgrade php-soapUpgrade php-ncursesUpgrade php53-odbcUpgrade php53-pdoUpgrade php-gdUpgrade php-cliUpgrade php53-mbstringUpgrade phpUpgrade php-imapUpgrade php-recodeUpgrade php-pspellUpgrade php53-pspellUpgrade php-bcmathUpgrade php53-imapUpgrade php53-cliUpgrade php53-dbaUpgrade php53-mysqlUpgrade php-mysqlUpgrade php-xmlrpcUpgrade php-xmlUpgrade php53-xmlrpcUpgrade php53-develUpgrade php-mbstringUpgrade php53-processUpgrade php53-commonUpgrade php53-ldapUpgrade php-commonUpgrade php-snmpUpgrade php53-bcmathUpgrade php53-pgsqlUpgrade php-odbcUpgrade php-pgsqlUpgrade php53-intlUpgrade php53-soapUpgrade php-process | Dec 1, 2016 | Feb 14, 2012 |
| Freebsd | — | Upgrade php52Upgrade php5Upgrade php53 | Dec 10, 2025 | Sep 19, 2012 |
| Gentoo Linux | — | Upgrade dev-lang/php. | Oct 30, 2017 | Feb 14, 2012 |
| Oracle_linux | — | Upgrade php53-pspellUpgrade php-commonUpgrade php53-bcmathUpgrade php-ncursesUpgrade php53-intlUpgrade php-ldapUpgrade php-intlUpgrade php-soapUpgrade php53-mysqlUpgrade php53-imapUpgrade php53-cliUpgrade php-pspellUpgrade php-odbcUpgrade php53-xmlUpgrade php-bcmathUpgrade php53-ldapUpgrade php-dbaUpgrade php-mysqlUpgrade php-pgsqlUpgrade php53-dbaUpgrade php-gdUpgrade php-pdoUpgrade php53-xmlrpcUpgrade php53-pgsqlUpgrade php53Upgrade php-ztsUpgrade php-embeddedUpgrade php-xmlrpcUpgrade php53-soapUpgrade php-develUpgrade php53-gdUpgrade php53-processUpgrade php-recodeUpgrade php-xmlUpgrade php-processUpgrade php-imapUpgrade phpUpgrade php-tidyUpgrade php53-pdoUpgrade php-snmpUpgrade php53-odbcUpgrade php53-mbstringUpgrade php53-commonUpgrade php-mbstringUpgrade php-enchantUpgrade php-cliUpgrade php53-snmpUpgrade php53-devel | Oct 16, 2024 | Feb 14, 2012 |
| Php | — | Upgrade to PHP version 5.3.9 | Oct 1, 2012 | Feb 14, 2012 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jan 11, 2012 |
| Suse | — | Upgrade php53-xslUpgrade php53-ctypeUpgrade php53-pcntlUpgrade php53-calendarUpgrade php53-gdUpgrade php53-sysvsemUpgrade php53-sysvshmUpgrade php53-jsonUpgrade php53-intlUpgrade php53-snmpUpgrade php53-xmlwriterUpgrade php53Upgrade apache2-mod_php53Upgrade php53-fileinfoUpgrade php53-soapUpgrade php53-zlibUpgrade php53-pdoUpgrade php53-readlineUpgrade php53-mcryptUpgrade php53-sqliteUpgrade php53-suhosinUpgrade php53-exifUpgrade php53-ldapUpgrade php53-develUpgrade php53-bcmathUpgrade php53-pgsqlUpgrade php53-fastcgiUpgrade php53-bz2Upgrade php53-imapUpgrade php53-domUpgrade php53-curlUpgrade php53-opensslUpgrade php53-pearUpgrade php53-shmopUpgrade php53-zipUpgrade php53-gettextUpgrade php53-ftpUpgrade php53-tidyUpgrade php53-socketsUpgrade php53-wddxUpgrade php53-iconvUpgrade php53-sysvmsgUpgrade php53-mysqlUpgrade php53-dbaUpgrade php53-xmlrpcUpgrade php53-tokenizerUpgrade php53-mbstringUpgrade php53-pspellUpgrade php53-posixUpgrade php53-gmpUpgrade php53-odbcUpgrade php53-xmlreader | Feb 17, 2015 | Jun 28, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub