NVD

Id
13581  
Name
CVE-2010-2094  
Description
Multiple format string vulnerabilities in the phar extension in PHP 5.3 before 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code via a crafted phar:// URI that is not properly handled by the (1) phar_stream_flush, (2) phar_wrapper_unlink, (3) phar_parse_url, or (4) phar_wrapper_open_url functions in ext/phar/stream.c; and the (5) phar_wrapper_open_dir function in ext/phar/dirstream.c, which triggers errors in the php_stream_wrapper_log_error function.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-18  
Published
2010-05-27  
Modified Date
2011-01-26  
Seq
2010-2094  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
74971 13581 CVE-2010-2094 SUSE-SR:2010:017  View
74972 13581 CVE-2010-2094 SUSE-SR:2010:018  View
74973 13581 CVE-2010-2094 http://php-security.org/2010/05/14/mops-2010-024-php-phar_stream_flush-format-string-vulnerability/index.html  View
74974 13581 CVE-2010-2094 http://php-security.org/2010/05/14/mops-2010-025-php-phar_wrapper_open_dir-format-string-vulnerability/index.html  View
74975 13581 CVE-2010-2094 http://php-security.org/2010/05/14/mops-2010-026-php-phar_wrapper_unlink-format-string-vulnerability/index.html  View
74976 13581 CVE-2010-2094 http://php-security.org/2010/05/14/mops-2010-027-php-phar_parse_url-format-string-vulnerabilities/index.html  View
74977 13581 CVE-2010-2094 http://php-security.org/2010/05/14/mops-2010-028-php-phar_wrapper_open_url-format-string-vulnerabilities/index.html  View
74978 13581 CVE-2010-2094 MDVSA-2011:004  View
74979 13581 CVE-2010-2094 ADV-2011-0068  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
36059 JVNDB-2010-001839 PHP の phar 拡張における重要な情報を取得される脆弱性 PHP の phar 拡張には、phar_stream_flush、phar_wrapper_unlink、phar_parse_url、ext/phar /stream.c 内の phar_wrapper_open_url 関数および ext/phar/dirstream.c 内の phar_wrapper_open_dir 関数を適切に処理しないため、重要な情報を取得される、または任意のコードを実行される脆弱性が存在します。 CVE-2010-2094 44674 CVE-2010-2094 13581 5 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001839.html 2010-05-14 2010-08-18 View