Project

General

Profile

Bug #1717

Multiple vulnerabilies in php < 5.3.22 allow information disclosure

Added by Leonardo Arena about 6 years ago. Updated about 6 years ago.

Status:
Closed
Priority:
High
Assignee:
-
Category:
Security
Target version:
Start date:
03/25/2013
Due date:
% Done:

100%

Estimated time:
(Total: 0.00 h)
Affected versions:
Security IDs:

Description

CVE-2013-1635
ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before 5.4.13 does not validate the relationship between the soap.wsdl_cache_dir directive and the open_basedir directive, which allows remote attackers to bypass intended access restrictions by triggering the creation of cached SOAP WSDL files in an arbitrary directory.

CVE-2013-1643
The SOAP parser in PHP before 5.3.22 and 5.4.x before 5.4.13 allows remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue in the soap_xmlParseFile and soap_xmlParseMemory functions.


Subtasks

Bug #1718: Multiple vulnerabilies in php < 5.3.22 allow information disclosureClosed

Bug #1719: Multiple vulnerabilies in php < 5.3.22 allow information disclosureClosed

Bug #1720: Multiple vulnerabilies in php < 5.3.22 allow information disclosureClosed

Bug #1721: Multiple vulnerabilies in php < 5.3.22 allow information disclosureClosed

History

#1 Updated by Natanael Copa about 6 years ago

  • Status changed from New to Resolved

fixed with the 5.3.23 upgrade

#2 Updated by Natanael Copa about 6 years ago

  • Project changed from Alpine Security to Alpine Linux
  • Category set to Security
  • Status changed from Resolved to Closed

Also available in: Atom PDF