Login Request a demo
Unscored severity · published Jan 18, 2012
CVE-2011-4153
PHP 5.3.8 does not always check the return value of the zend_strndup function, which might allow remote attackers to cause a denial of service (NULL pointer dereference and…
–
CVSS
11.8%
EPSS
No
On KEV
Description
PHP 5.3.8 does not always check the return value of the zend_strndup function, which might allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted input to an application that performs strndup operations on untrusted string data, as demonstrated by the define function in zend_builtin_functions.c, and unspecified functions in ext/soap/php_sdl.c, ext/standard/syslog.c, ext/standard/browscap.c, ext/oci8/oci8.c, ext/com_dotnet/com_typeinfo.c, and main/php_open_temporary_file.c.
Exploitation
Is it being used?
Exploit prediction (EPSS)11.8% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PH
PHP · PHP
5.3.8 · source: NVD
Affected product
PH
PHP
PHP
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-4153
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-4153
Exploit
http://archives.neohapsis.com/archives/bugtraq/2012-01/0092.html
Exploit
http://cxsecurity.com/research/103
h20000.www2.hp.com
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00013.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00016.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00001.html
More from PHP
9.8
CVE-2026-109618
RCE via OOM corruption
9.8
CVE-2024-4577
Argument Injection in PHP-CGI
9.8
CVE-2019-11043
Underflow in PHP-FPM can lead to RCE
9.8
CVE-2016-10033
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute…
9.8
CVE-2012-1823
PHP-CGI Query String Parameter Vulnerability