Unscored severity · published Dec 17, 2013
CVE-2013-6420
The asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse (1) notBefore and (2) notAfter…
–
CVSS
35.6%
EPSS
No
On KEV
Description
The asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse (1) notBefore and (2) notAfter timestamps in X.509 certificates, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted certificate that is not properly handled by the openssl_x509_parse function.
Exploitation
Is it being used?
Exploit prediction (EPSS)35.6% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PH
PHP · PHP
5.4.0; 5.4.1; 5.4.2; 5.4.3; 5.4.4; 5.4.5; +34 more · source: NVD
MO
Mac OS X · Apple
through 10.9.1 · source: NVD
OP
Opensuse · Opensuse
11.4; 12.2; 12.3; 13.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-6420
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-6420
forums.interworx.com
http://forums.interworx.com/threads/8000-InterWorx-Version-5-0-14-Released-on-Beta-Channel%21
git.php.net
http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=c1224573c773b6845e83505f717fbf820fc18415
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2013-12/msg00125.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2013-12/msg00126.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2013-1813.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2013-1815.html
More from PHP
9.8
CVE-2026-109618
RCE via OOM corruption
9.8
CVE-2024-4577
Argument Injection in PHP-CGI
9.8
CVE-2019-11043
Underflow in PHP-FPM can lead to RCE
9.8
CVE-2016-10033
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute…
9.8
CVE-2012-1823
PHP-CGI Query String Parameter Vulnerability