CVE Vulnerabilities

CVE-2011-1153

Use of Externally-Controlled Format String

Published: Mar 16, 2011 | Modified: Apr 11, 2025
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
7.5 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P
RedHat/V2
4.3 MODERATE
AV:N/AC:M/Au:N/C:P/I:N/A:N
RedHat/V3
Ubuntu
MEDIUM

Multiple format string vulnerabilities in phar_object.c in the phar extension in PHP 5.3.5 and earlier allow context-dependent attackers to obtain sensitive information from process memory, cause a denial of service (memory corruption), or possibly execute arbitrary code via format string specifiers in an argument to a class method, leading to an incorrect zend_throw_exception_ex call.

Weakness

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

Affected Software

Name Vendor Start Version End Version
Php Php * 5.3.5 (including)
Php Php 1.0 (including) 1.0 (including)
Php Php 2.0 (including) 2.0 (including)
Php Php 2.0b10 (including) 2.0b10 (including)
Php Php 3.0 (including) 3.0 (including)
Php Php 3.0.1 (including) 3.0.1 (including)
Php Php 3.0.2 (including) 3.0.2 (including)
Php Php 3.0.3 (including) 3.0.3 (including)
Php Php 3.0.4 (including) 3.0.4 (including)
Php Php 3.0.5 (including) 3.0.5 (including)
Php Php 3.0.6 (including) 3.0.6 (including)
Php Php 3.0.7 (including) 3.0.7 (including)
Php Php 3.0.8 (including) 3.0.8 (including)
Php Php 3.0.9 (including) 3.0.9 (including)
Php Php 3.0.10 (including) 3.0.10 (including)
Php Php 3.0.11 (including) 3.0.11 (including)
Php Php 3.0.12 (including) 3.0.12 (including)
Php Php 3.0.13 (including) 3.0.13 (including)
Php Php 3.0.14 (including) 3.0.14 (including)
Php Php 3.0.15 (including) 3.0.15 (including)
Php Php 3.0.16 (including) 3.0.16 (including)
Php Php 3.0.17 (including) 3.0.17 (including)
Php Php 3.0.18 (including) 3.0.18 (including)
Php Php 4.0-beta_4_patch1 (including) 4.0-beta_4_patch1 (including)
Php Php 4.0-beta1 (including) 4.0-beta1 (including)
Php Php 4.0-beta2 (including) 4.0-beta2 (including)
Php Php 4.0-beta3 (including) 4.0-beta3 (including)
Php Php 4.0-beta4 (including) 4.0-beta4 (including)
Php Php 4.0.0 (including) 4.0.0 (including)
Php Php 4.0.1 (including) 4.0.1 (including)
Php Php 4.0.2 (including) 4.0.2 (including)
Php Php 4.0.3 (including) 4.0.3 (including)
Php Php 4.0.4 (including) 4.0.4 (including)
Php Php 4.0.5 (including) 4.0.5 (including)
Php Php 4.0.6 (including) 4.0.6 (including)
Php Php 4.0.7 (including) 4.0.7 (including)
Php Php 4.1.0 (including) 4.1.0 (including)
Php Php 4.1.1 (including) 4.1.1 (including)
Php Php 4.1.2 (including) 4.1.2 (including)
Php Php 4.2.0 (including) 4.2.0 (including)
Php Php 4.2.1 (including) 4.2.1 (including)
Php Php 4.2.2 (including) 4.2.2 (including)
Php Php 4.2.3 (including) 4.2.3 (including)
Php Php 4.3.0 (including) 4.3.0 (including)
Php Php 4.3.1 (including) 4.3.1 (including)
Php Php 4.3.2 (including) 4.3.2 (including)
Php Php 4.3.3 (including) 4.3.3 (including)
Php Php 4.3.4 (including) 4.3.4 (including)
Php Php 4.3.5 (including) 4.3.5 (including)
Php Php 4.3.6 (including) 4.3.6 (including)
Php Php 4.3.7 (including) 4.3.7 (including)
Php Php 4.3.8 (including) 4.3.8 (including)
Php Php 4.3.9 (including) 4.3.9 (including)
Php Php 4.3.10 (including) 4.3.10 (including)
Php Php 4.3.11 (including) 4.3.11 (including)
Php Php 4.4.0 (including) 4.4.0 (including)
Php Php 4.4.1 (including) 4.4.1 (including)
Php Php 4.4.2 (including) 4.4.2 (including)
Php Php 4.4.3 (including) 4.4.3 (including)
Php Php 4.4.4 (including) 4.4.4 (including)
Php Php 4.4.5 (including) 4.4.5 (including)
Php Php 4.4.6 (including) 4.4.6 (including)
Php Php 4.4.7 (including) 4.4.7 (including)
Php Php 4.4.8 (including) 4.4.8 (including)
Php Php 4.4.9 (including) 4.4.9 (including)
Php Php 5.0.0 (including) 5.0.0 (including)
Php Php 5.0.0-beta1 (including) 5.0.0-beta1 (including)
Php Php 5.0.0-beta2 (including) 5.0.0-beta2 (including)
Php Php 5.0.0-beta3 (including) 5.0.0-beta3 (including)
Php Php 5.0.0-beta4 (including) 5.0.0-beta4 (including)
Php Php 5.0.0-rc1 (including) 5.0.0-rc1 (including)
Php Php 5.0.0-rc2 (including) 5.0.0-rc2 (including)
Php Php 5.0.0-rc3 (including) 5.0.0-rc3 (including)
Php Php 5.0.1 (including) 5.0.1 (including)
Php Php 5.0.2 (including) 5.0.2 (including)
Php Php 5.0.3 (including) 5.0.3 (including)
Php Php 5.0.4 (including) 5.0.4 (including)
Php Php 5.0.5 (including) 5.0.5 (including)
Php Php 5.1.0 (including) 5.1.0 (including)
Php Php 5.1.1 (including) 5.1.1 (including)
Php Php 5.1.2 (including) 5.1.2 (including)
Php Php 5.1.3 (including) 5.1.3 (including)
Php Php 5.1.4 (including) 5.1.4 (including)
Php Php 5.1.5 (including) 5.1.5 (including)
Php Php 5.1.6 (including) 5.1.6 (including)
Php Php 5.2.0 (including) 5.2.0 (including)
Php Php 5.2.1 (including) 5.2.1 (including)
Php Php 5.2.2 (including) 5.2.2 (including)
Php Php 5.2.3 (including) 5.2.3 (including)
Php Php 5.2.4 (including) 5.2.4 (including)
Php Php 5.2.5 (including) 5.2.5 (including)
Php Php 5.2.6 (including) 5.2.6 (including)
Php Php 5.2.8 (including) 5.2.8 (including)
Php Php 5.2.9 (including) 5.2.9 (including)
Php Php 5.2.10 (including) 5.2.10 (including)
Php Php 5.2.11 (including) 5.2.11 (including)
Php Php 5.2.12 (including) 5.2.12 (including)
Php Php 5.2.13 (including) 5.2.13 (including)
Php Php 5.2.14 (including) 5.2.14 (including)
Php Php 5.3.0 (including) 5.3.0 (including)
Php Php 5.3.1 (including) 5.3.1 (including)
Php Php 5.3.2 (including) 5.3.2 (including)
Php Php 5.3.3 (including) 5.3.3 (including)
Php Php 5.3.4 (including) 5.3.4 (including)
Php5 Ubuntu lucid *
Php5 Ubuntu maverick *
Php5 Ubuntu natty *

Potential Mitigations

References