NVD

Id
41478  
Name
CVE-2013-6420  
Description
The asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse (1) notBefore and (2) notAfter timestamps in X.509 certificates, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted certificate that is not properly handled by the openssl_x509_parse function.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-18  
Published
2013-12-16  
Modified Date
2016-11-28  
Seq
2013-6420  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
209573 41478 CVE-2013-6420 http://forums.interworx.com/threads/8000-InterWorx-Version-5-0-14-Released-on-Beta-Channel!  View
209574 41478 CVE-2013-6420 http://git.php.net/?p=php-src.git;a=commit;h=c1224573c773b6845e83505f717fbf820fc18415  View
209575 41478 CVE-2013-6420 openSUSE-SU-2013:1963  View
209576 41478 CVE-2013-6420 openSUSE-SU-2013:1964  View
209577 41478 CVE-2013-6420 http://support.apple.com/kb/HT6150  View
209578 41478 CVE-2013-6420 http://www.php.net/ChangeLog-5.php  View
209579 41478 CVE-2013-6420 64225  View
209580 41478 CVE-2013-6420 1029472  View
209581 41478 CVE-2013-6420 https://bugzilla.redhat.com/show_bug.cgi?id=1036830  View
209582 41478 CVE-2013-6420 SSRT101447  View
209583 41478 CVE-2013-6420 https://www.sektioneins.de/advisories/advisory-012013-php-openssl_x509_parse-memory-corruption-vulnerability.html  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
24010 JVNDB-2013-005585 PHP の ext/openssl/openssl.c 内の asn1_time_to_time_t 関数における任意のコードを実行される脆弱性 PHP の ext/openssl/openssl.c 内の asn1_time_to_time_t 関数は、X.509 証明書の (1) notBefore および (2) notAfter タイムスタンプを適切に解析しないため、任意のコードを実行される、またはサービス運用妨害 (メモリ破損) 状態にされる脆弱性が存在します。 CVE-2013-6420 66362 CVE-2013-6420 41478 7.5 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-005585.html 2013-12-11 2015-08-10 View