Description

Integer signedness error in zip_stream.c in the Zip extension in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (CPU consumption) via a malformed archive file that triggers errors in zip_fread function calls.

Remediation

References

CVE-2011-1471

Related Vulnerabilities

WordPress Plugin WP Docs Multiple Vulnerabilities (1.1.7)

PHP Other Vulnerability (CVE-2007-0907)

PHP Uncontrolled Resource Consumption Vulnerability (CVE-2015-9253)

Django Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2013-4249)

Apache Traffic Server Exposure of Resource to Wrong Sphere Vulnerability (CVE-2018-8040)

Severity

Medium

Classification

CVE-2011-1471

Tags

Missing Update Known Vulnerabilities