Description

The var_export function in PHP 5.2 before 5.2.14 and 5.3 before 5.3.3 flushes the output buffer to the user when certain fatal errors occur, even if display_errors is off, which allows remote attackers to obtain sensitive information by causing the application to exceed limits for memory, execution time, or recursion.

Remediation

References

CVE-2010-2531

Related Vulnerabilities

SugarCRM Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2019-17319)

Oracle Database Server CVE-2013-3760 Vulnerability (CVE-2013-3760)

WordPress Plugin Premmerce Permalink Manager for WooCommerce Local File Inclusion (2.3.10)

WordPress Plugin Google Captcha (reCAPTCHA) by BestWebSoft Security Bypass (1.12)

Liferay DXP Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-33944)

Severity

Medium

Classification

CVE-2010-2531 CWE-200

Tags

Missing Update Known Vulnerabilities