Description

The is_a function in PHP 5.3.7 and 5.3.8 triggers a call to the __autoload function, which makes it easier for remote attackers to execute arbitrary code by providing a crafted URL and leveraging potentially unsafe behavior in certain PEAR packages and custom autoloaders.

Remediation

References

CVE-2011-3379

Related Vulnerabilities

Drupal Core 4.7.x Cross-Site Scripting (4.7.0 - 4.7.1)

WordPress Plugin Blog2Social:Social Media Auto Post & Scheduler Unspecified Vulnerability (5.1.2)

PostgreSQL Numeric Errors Vulnerability (CVE-2014-0064)

WordPress Plugin Quotes Collection Cross-Site Scripting (2.0.5)

Ruby Numeric Errors Vulnerability (CVE-2008-2376)

Severity

High

Classification

CVE-2011-3379 CWE-94

Tags

Missing Update Known Vulnerabilities