CVE-2011-3336: regcomp in the BSD implementation of libc is vulnerable to denial of service due to stack exhaustion

High severity · published Feb 12, 2020

CVE-2011-3336

regcomp in the BSD implementation of libc is vulnerable to denial of service due to stack exhaustion

7.5

CVSS

6.5%

EPSS

On KEV

Description

regcomp in the BSD implementation of libc is vulnerable to denial of service due to stack exhaustion.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)6.5% · higher than 94% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

PHP · PHP

5.3.0 through 5.3.10 · source: NVD

Freebsd · Freebsd

8.2 · source: NVD

Mac OS X · Apple

10.6.0 through 10.7.2 · source: NVD

Openbsd · Openbsd

5.0 · source: NVD

Affected product

PHP

All PHP CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2011-3336

CVE.org

https://www.cve.org/CVERecord?id=CVE-2011-3336

Exploit

http://seclists.org/fulldisclosure/2014/Mar/166

Exploit

http://www.securityfocus.com/bid/50541

Exploit

https://cxsecurity.com/issue/WLB-2011110082

Exploit

https://www.securityfocus.com/archive/1/520390