Computer Security
[EN] securityvulns.ru no-pyccku


PHP securiy vulnerabilities
Published:02.03.2013
Source:
SecurityVulns ID:12914
Type:remote
Threat Level:
5/10
Description:safe_dir protection bypass and code execution on SOAP handling.
Affected:PHP : PHP 5.3
CVE:CVE-2013-1643 (The SOAP parser in PHP before 5.3.22 and 5.4.x before 5.4.13 allows remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue in the soap_xmlParseFile and soap_xmlParseMemory functions.)
 CVE-2013-1635 (ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before 5.4.13 does not validate the relationship between the soap.wsdl_cache_dir directive and the open_basedir directive, which allows remote attackers to bypass intended access restrictions by triggering the creation of cached SOAP WSDL files in an arbitrary directory.)
Original documentdocumentMANDRIVA, [ MDVSA-2013:016 ] php (02.03.2013)

About | Terms of use | Privacy Policy
© SecurityVulns, 3APA3A, Vladimir Dubrovin
Nizhny Novgorod