Description

The scan function in ext/date/lib/parse_iso_intervals.c in PHP through 5.5.6 does not properly restrict creation of DateInterval objects, which might allow remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted interval specification.

Remediation

References

CVE-2013-6712

Related Vulnerabilities

WordPress Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2015-5734)

WordPress Plugin WP Email Template PHP Object Injection (2.4.0)

WordPress Plugin Count per Day SQL Injection (3.4)

Jenkins Permissions, Privileges, and Access Controls Vulnerability (CVE-2015-1810)

WordPress Plugin Eventr SQL Injection (1.02.2)

Severity

Medium

Classification

CVE-2013-6712 CWE-119

Tags

Missing Update Known Vulnerabilities