CVE-2013-6420

35Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 36%

from disclosure to weapon0 days

Published on NVDDec 17

1st PoCDec 17

exploitation probability

36%top 2% of all CVEs

observed exploitation

nono source reports it

1 public exploit(s)

The asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse (1) notBefore and (2) notAfter timestamps in X.509 certificates, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted certificate that is not properly handled by the openssl_x509_parse function.

Affected products

n/a · n/a

public PoCs found — 1

exploitdbwww.exploit-db.com/exploits/30395unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://forums.interworx.com/threads/8000-InterWorx-Version-5-0-14-Released-on-Beta-Channel%21 http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=c1224573c773b6845e83505f717fbf820fc18415 http://lists.opensuse.org/opensuse-updates/2013-12/msg00125.html http://lists.opensuse.org/opensuse-updates/2013-12/msg00126.html http://rhn.redhat.com/errata/RHSA-2013-1813.html http://rhn.redhat.com/errata/RHSA-2013-1815.html http://rhn.redhat.com/errata/RHSA-2013-1824.html http://rhn.redhat.com/errata/RHSA-2013-1825.html http://rhn.redhat.com/errata/RHSA-2013-1826.html https://bugzilla.redhat.com/show_bug.cgi?id=1036830 http://secunia.com/advisories/59652 https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04463322