ID

VAR-201205-0305


CVE

CVE-2012-1823


TITLE

PHP ‘ php-cgi ’ Parameter information leak vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-201205-108

DESCRIPTION

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case. PHP is prone to an information-disclosure vulnerability. Exploiting this issue allows remote attackers to view the source code of files in the context of the server process. This may allow the attacker to obtain sensitive information and to run arbitrary PHP code on the affected computer; other attacks are also possible. ---------------------------------------------------------------------- Become a PSI 3.0 beta tester! Test-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface. Download it here! http://secunia.com/psi_30_beta_launch ---------------------------------------------------------------------- TITLE: PHP PHP-CGI QUERY_STRING Parameter Vulnerability SECUNIA ADVISORY ID: SA49014 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/49014/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=49014 RELEASE DATE: 2012-05-04 DISCUSS ADVISORY: http://secunia.com/advisories/49014/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/49014/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=49014 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: De Eindbazen has reported a vulnerability in PHP, which can be exploited by malicious people to disclose certain sensitive information or compromise a vulnerable system. The vulnerability is caused due to an error when parsing certain QUERY_STRING parameters. This can be exploited to e.g. SOLUTION: Apply patch or workaround. Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ PROVIDED AND/OR DISCOVERED BY: De Eindbazen ORIGINAL ADVISORY: PHP: https://bugs.php.net/bug.php?id=61910 De Eindbazen: http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/ US-CERT VU#520827: http://www.kb.cert.org/vuls/id/520827 OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . HP System Management Homepage (SMH) before v7.1.1 running on Linux and Windows. HP System Management Homepage v7.1.1 is available here: HP System Management Homepage for Windows x64 [Download here] or enter the following URL into the browser address window. http://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/psi/swdDetail s/?sp4ts.oid=4091409&spf_p.tpst=psiSwdMain&spf_p.prp_psiSwdMain=wsrp-navigati onalState%3Dlang%253Den%257Ccc%253DUS%257CprodSeriesId%253D4091408%257CprodNa meId%253D4091409%257CswEnvOID%253D4064%257CswLang%253D8%257CswItem%253DMTX-ab 0d4e9bb4654a8da503eccfd9%257Cmode%253D3%257Caction%253DdriverDocument&javax.p ortlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vign ette.cachetoken HP System Management Homepage for Windows x86 [Download here] or enter the following URL into the browser address window. http://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/psi/swdDetail s/?sp4ts.oid=4091409&spf_p.tpst=psiSwdMain&spf_p.prp_psiSwdMain=wsrp-navigati onalState%3Dlang%253Den%257Ccc%253DUS%257CprodSeriesId%253D4091408%257CprodNa meId%253D4091409%257CswEnvOID%253D4022%257CswLang%253D8%257CswItem%253DMTX-f7 c0d15d28474255bd0ec23136%257Cmode%253D3%257Caction%253DdriverDocument&javax.p ortlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vign ette.cachetoken HP System Management Homepage for Linux (AMD64/EM64T) [Download here] or enter the following URL into the browser address window. http://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/psi/swdDetail s/?sp4ts.oid=4091409&spf_p.tpst=psiSwdMain&spf_p.prp_psiSwdMain=wsrp-navigati onalState%3Dlang%253Den%257Ccc%253DUS%257CprodSeriesId%253D4091408%257CprodNa meId%253D4091409%257CswEnvOID%253D4035%257CswLang%253D8%257CswItem%253DMTX-18 d373dd1361400fbaca892942%257Cmode%253D3%257Caction%253DdriverDocument&javax.p ortlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vign ette.cachetoken HP System Management Homepage for Linux (x86) [Download here] or enter the following URL into the browser address window. Additionally, this update fixes insufficient validation of upload name which lead to corrupted $_FILES indices. For the stable distribution (squeeze), this problem has been fixed in version 5.3.3-7+squeeze9. The testing distribution (wheezy) will be fixed soon. For the unstable distribution (sid), this problem has been fixed in version 5.4.3-1. We recommend that you upgrade your php5 packages. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c03368475 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03368475 Version: 1 HPSBUX02791 SSRT100856 rev.1 - HP-UX Apache Web Server running PHP, Remote Execution of Arbitrary Code, Privilege Elevation, Denial of Service (DoS) NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2012-06-14 Last Updated: 2012-06-14 Potential Security Impact: Remote execution of arbitrary code, privilege elevation, or Denial of Service (DoS). Source: Hewlett-Packard Company, HP Software Security Response Team VULNERABILITY SUMMARY Potential security vulnerabilities have been identified with HP-UX Apache Web Server running PHP. These vulnerabilities could be exploited remotely to execute arbitrary code, elevate privileges, or create a Denial of Service (DoS). References: CVE-2011-4153, CVE-2012-0830, CVE-2012-0883, CVE-2012-1172, CVE-2012-1823, CVE-2012-2311 SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. HP-UX B.11.23, B.11.31 running HP-UX Apache Web Server Suite v3.24 or earlier BACKGROUND For a PGP signed CVSS 2.0 Base Metrics =========================================================== Reference Base Vector Base Score CVE-2011-4153 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0 CVE-2012-0830 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5 CVE-2012-0883 (AV:L/AC:M/Au:N/C:C/I:C/A:C) 6.9 CVE-2012-1172 (AV:N/AC:M/Au:N/C:N/I:P/A:P) 5.8 CVE-2012-1823 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5 CVE-2012-2311 (AV:N/AC:L/Au:N/C:P/I:P/A:P) 7.5 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002 RESOLUTION HP has provided the following software updates to resolve the vulnerabilities. The updates are available for download from http://software.hp.com HP-UX Web Server Suite v.3.24 containing Apache v2.2.15.13 and PHP v5.2.17 HP-UX 11i Release Apache Depot name B.11.23 (32-bit) HPUXWS22ATW-B324-32 B.11.23 (64-bit) HPUXWS22ATW-B324-64 B.11.31 (32-bit) HPUXWS22ATW-B324-32 B.11.31 (64-bit) HPUXWS22ATW-B324-64 MANUAL ACTIONS: Yes - Update Install HP-UX Web Server Suite v3.24 or subsequent. PRODUCT SPECIFIC INFORMATION HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all Security Bulletins issued by HP and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see https://www.hp.com/go/swa The following text is for use by the HP-UX Software Assistant. HP-UX Web Server Suite v3.24 AFFECTED VERSIONS HP-UX B.11.23 ============== hpuxws22APCH32.APACHE hpuxws22APCH32.APACHE2 hpuxws22APCH32.AUTH_LDAP hpuxws22APCH32.AUTH_LDAP2 hpuxws22APCH32.MOD_JK hpuxws22APCH32.MOD_JK2 hpuxws22APCH32.MOD_PERL hpuxws22APCH32.MOD_PERL2 hpuxws22APCH32.PHP hpuxws22APCH32.PHP2 hpuxws22APCH32.WEBPROXY hpuxws22APCH32.WEBPROXY2 hpuxws22APACHE.APACHE hpuxws22APACHE.APACHE2 hpuxws22APACHE.AUTH_LDAP hpuxws22APACHE.AUTH_LDAP2 hpuxws22APACHE.MOD_JK hpuxws22APACHE.MOD_JK2 hpuxws22APACHE.MOD_PERL hpuxws22APACHE.MOD_PERL2 hpuxws22APACHE.PHP hpuxws22APACHE.PHP2 hpuxws22APACHE.WEBPROXY hpuxws22APACHE.WEBPROXY2 action: install revision B.2.2.15.13 or subsequent HP-UX B.11.31 ================== hpuxws22APCH32.APACHE hpuxws22APCH32.APACHE2 hpuxws22APCH32.AUTH_LDAP hpuxws22APCH32.AUTH_LDAP2 hpuxws22APCH32.MOD_JK hpuxws22APCH32.MOD_JK2 hpuxws22APCH32.MOD_PERL hpuxws22APCH32.MOD_PERL2 hpuxws22APCH32.PHP hpuxws22APCH32.PHP2 hpuxws22APCH32.WEBPROXY hpuxws22APCH32.WEBPROXY2 hpuxws22APACHE.APACHE hpuxws22APACHE.APACHE2 hpuxws22APACHE.AUTH_LDAP hpuxws22APACHE.AUTH_LDAP2 hpuxws22APACHE.MOD_JK hpuxws22APACHE.MOD_JK2 hpuxws22APACHE.MOD_PERL hpuxws22APACHE.MOD_PERL2 hpuxws22APACHE.PHP hpuxws22APACHE.PHP2 hpuxws22APACHE.WEBPROXY hpuxws22APACHE.WEBPROXY2 action: install revision B.2.2.15.13 or subsequent END AFFECTED VERSIONS HISTORY Version:1 (rev.1) - 14 June 2012 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HP Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hp.com. Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com Subscribe: To initiate a subscription to receive future HP Security Bulletin alerts via Email: http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins Security Bulletin List: A list of HP Security Bulletins, updated periodically, is contained in HP Security Notice HPSN-2011-001: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c02964430 Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://h20566.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/ Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HP General Software HF = HP Hardware and Firmware MP = MPE/iX MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PI = Printing and Imaging PV = ProCurve ST = Storage Software TU = Tru64 UNIX UX = HP-UX Copyright 2012 Hewlett-Packard Development Company, L.P. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits;damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. This fixes a vulnerability, which can be exploited by malicious people to disclose certain sensitive information or compromise a vulnerable system. For more information see vulnerability #1 in: SA49014 SOLUTION: Apply updated packages via the apt-get package manager. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: php53 security update Advisory ID: RHSA-2012:0547-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2012-0547.html Issue date: 2012-05-07 CVE Names: CVE-2012-1823 ===================================================================== 1. Summary: Updated php53 packages that fix one security issue are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having critical security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Description: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. A flaw was found in the way the php-cgi executable processed command line arguments when running in CGI mode. A remote attacker could send a specially-crafted request to a PHP script that would result in the query string being parsed by php-cgi as command line options and arguments. (CVE-2012-1823) Red Hat is aware that a public exploit for this issue is available that allows remote code execution in affected PHP CGI configurations. This flaw does not affect the default configuration using the PHP module for Apache httpd to handle PHP scripts. All php53 users should upgrade to these updated packages, which contain a backported patch to resolve this issue. After installing the updated packages, the httpd daemon must be restarted for the update to take effect. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 5. Bugs fixed (http://bugzilla.redhat.com/): 818607 - CVE-2012-1823 php: command line arguments injection when run in CGI mode (VU#520827) 6. Package List: RHEL Desktop Workstation (v. 5 client): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/php53-5.3.3-7.el5_8.src.rpm i386: php53-5.3.3-7.el5_8.i386.rpm php53-bcmath-5.3.3-7.el5_8.i386.rpm php53-cli-5.3.3-7.el5_8.i386.rpm php53-common-5.3.3-7.el5_8.i386.rpm php53-dba-5.3.3-7.el5_8.i386.rpm php53-debuginfo-5.3.3-7.el5_8.i386.rpm php53-devel-5.3.3-7.el5_8.i386.rpm php53-gd-5.3.3-7.el5_8.i386.rpm php53-imap-5.3.3-7.el5_8.i386.rpm php53-intl-5.3.3-7.el5_8.i386.rpm php53-ldap-5.3.3-7.el5_8.i386.rpm php53-mbstring-5.3.3-7.el5_8.i386.rpm php53-mysql-5.3.3-7.el5_8.i386.rpm php53-odbc-5.3.3-7.el5_8.i386.rpm php53-pdo-5.3.3-7.el5_8.i386.rpm php53-pgsql-5.3.3-7.el5_8.i386.rpm php53-process-5.3.3-7.el5_8.i386.rpm php53-pspell-5.3.3-7.el5_8.i386.rpm php53-snmp-5.3.3-7.el5_8.i386.rpm php53-soap-5.3.3-7.el5_8.i386.rpm php53-xml-5.3.3-7.el5_8.i386.rpm php53-xmlrpc-5.3.3-7.el5_8.i386.rpm x86_64: php53-5.3.3-7.el5_8.x86_64.rpm php53-bcmath-5.3.3-7.el5_8.x86_64.rpm php53-cli-5.3.3-7.el5_8.x86_64.rpm php53-common-5.3.3-7.el5_8.x86_64.rpm php53-dba-5.3.3-7.el5_8.x86_64.rpm php53-debuginfo-5.3.3-7.el5_8.x86_64.rpm php53-devel-5.3.3-7.el5_8.x86_64.rpm php53-gd-5.3.3-7.el5_8.x86_64.rpm php53-imap-5.3.3-7.el5_8.x86_64.rpm php53-intl-5.3.3-7.el5_8.x86_64.rpm php53-ldap-5.3.3-7.el5_8.x86_64.rpm php53-mbstring-5.3.3-7.el5_8.x86_64.rpm php53-mysql-5.3.3-7.el5_8.x86_64.rpm php53-odbc-5.3.3-7.el5_8.x86_64.rpm php53-pdo-5.3.3-7.el5_8.x86_64.rpm php53-pgsql-5.3.3-7.el5_8.x86_64.rpm php53-process-5.3.3-7.el5_8.x86_64.rpm php53-pspell-5.3.3-7.el5_8.x86_64.rpm php53-snmp-5.3.3-7.el5_8.x86_64.rpm php53-soap-5.3.3-7.el5_8.x86_64.rpm php53-xml-5.3.3-7.el5_8.x86_64.rpm php53-xmlrpc-5.3.3-7.el5_8.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/php53-5.3.3-7.el5_8.src.rpm i386: php53-5.3.3-7.el5_8.i386.rpm php53-bcmath-5.3.3-7.el5_8.i386.rpm php53-cli-5.3.3-7.el5_8.i386.rpm php53-common-5.3.3-7.el5_8.i386.rpm php53-dba-5.3.3-7.el5_8.i386.rpm php53-debuginfo-5.3.3-7.el5_8.i386.rpm php53-devel-5.3.3-7.el5_8.i386.rpm php53-gd-5.3.3-7.el5_8.i386.rpm php53-imap-5.3.3-7.el5_8.i386.rpm php53-intl-5.3.3-7.el5_8.i386.rpm php53-ldap-5.3.3-7.el5_8.i386.rpm php53-mbstring-5.3.3-7.el5_8.i386.rpm php53-mysql-5.3.3-7.el5_8.i386.rpm php53-odbc-5.3.3-7.el5_8.i386.rpm php53-pdo-5.3.3-7.el5_8.i386.rpm php53-pgsql-5.3.3-7.el5_8.i386.rpm php53-process-5.3.3-7.el5_8.i386.rpm php53-pspell-5.3.3-7.el5_8.i386.rpm php53-snmp-5.3.3-7.el5_8.i386.rpm php53-soap-5.3.3-7.el5_8.i386.rpm php53-xml-5.3.3-7.el5_8.i386.rpm php53-xmlrpc-5.3.3-7.el5_8.i386.rpm ia64: php53-5.3.3-7.el5_8.ia64.rpm php53-bcmath-5.3.3-7.el5_8.ia64.rpm php53-cli-5.3.3-7.el5_8.ia64.rpm php53-common-5.3.3-7.el5_8.ia64.rpm php53-dba-5.3.3-7.el5_8.ia64.rpm php53-debuginfo-5.3.3-7.el5_8.ia64.rpm php53-devel-5.3.3-7.el5_8.ia64.rpm php53-gd-5.3.3-7.el5_8.ia64.rpm php53-imap-5.3.3-7.el5_8.ia64.rpm php53-intl-5.3.3-7.el5_8.ia64.rpm php53-ldap-5.3.3-7.el5_8.ia64.rpm php53-mbstring-5.3.3-7.el5_8.ia64.rpm php53-mysql-5.3.3-7.el5_8.ia64.rpm php53-odbc-5.3.3-7.el5_8.ia64.rpm php53-pdo-5.3.3-7.el5_8.ia64.rpm php53-pgsql-5.3.3-7.el5_8.ia64.rpm php53-process-5.3.3-7.el5_8.ia64.rpm php53-pspell-5.3.3-7.el5_8.ia64.rpm php53-snmp-5.3.3-7.el5_8.ia64.rpm php53-soap-5.3.3-7.el5_8.ia64.rpm php53-xml-5.3.3-7.el5_8.ia64.rpm php53-xmlrpc-5.3.3-7.el5_8.ia64.rpm ppc: php53-5.3.3-7.el5_8.ppc.rpm php53-bcmath-5.3.3-7.el5_8.ppc.rpm php53-cli-5.3.3-7.el5_8.ppc.rpm php53-common-5.3.3-7.el5_8.ppc.rpm php53-dba-5.3.3-7.el5_8.ppc.rpm php53-debuginfo-5.3.3-7.el5_8.ppc.rpm php53-devel-5.3.3-7.el5_8.ppc.rpm php53-gd-5.3.3-7.el5_8.ppc.rpm php53-imap-5.3.3-7.el5_8.ppc.rpm php53-intl-5.3.3-7.el5_8.ppc.rpm php53-ldap-5.3.3-7.el5_8.ppc.rpm php53-mbstring-5.3.3-7.el5_8.ppc.rpm php53-mysql-5.3.3-7.el5_8.ppc.rpm php53-odbc-5.3.3-7.el5_8.ppc.rpm php53-pdo-5.3.3-7.el5_8.ppc.rpm php53-pgsql-5.3.3-7.el5_8.ppc.rpm php53-process-5.3.3-7.el5_8.ppc.rpm php53-pspell-5.3.3-7.el5_8.ppc.rpm php53-snmp-5.3.3-7.el5_8.ppc.rpm php53-soap-5.3.3-7.el5_8.ppc.rpm php53-xml-5.3.3-7.el5_8.ppc.rpm php53-xmlrpc-5.3.3-7.el5_8.ppc.rpm s390x: php53-5.3.3-7.el5_8.s390x.rpm php53-bcmath-5.3.3-7.el5_8.s390x.rpm php53-cli-5.3.3-7.el5_8.s390x.rpm php53-common-5.3.3-7.el5_8.s390x.rpm php53-dba-5.3.3-7.el5_8.s390x.rpm php53-debuginfo-5.3.3-7.el5_8.s390x.rpm php53-devel-5.3.3-7.el5_8.s390x.rpm php53-gd-5.3.3-7.el5_8.s390x.rpm php53-imap-5.3.3-7.el5_8.s390x.rpm php53-intl-5.3.3-7.el5_8.s390x.rpm php53-ldap-5.3.3-7.el5_8.s390x.rpm php53-mbstring-5.3.3-7.el5_8.s390x.rpm php53-mysql-5.3.3-7.el5_8.s390x.rpm php53-odbc-5.3.3-7.el5_8.s390x.rpm php53-pdo-5.3.3-7.el5_8.s390x.rpm php53-pgsql-5.3.3-7.el5_8.s390x.rpm php53-process-5.3.3-7.el5_8.s390x.rpm php53-pspell-5.3.3-7.el5_8.s390x.rpm php53-snmp-5.3.3-7.el5_8.s390x.rpm php53-soap-5.3.3-7.el5_8.s390x.rpm php53-xml-5.3.3-7.el5_8.s390x.rpm php53-xmlrpc-5.3.3-7.el5_8.s390x.rpm x86_64: php53-5.3.3-7.el5_8.x86_64.rpm php53-bcmath-5.3.3-7.el5_8.x86_64.rpm php53-cli-5.3.3-7.el5_8.x86_64.rpm php53-common-5.3.3-7.el5_8.x86_64.rpm php53-dba-5.3.3-7.el5_8.x86_64.rpm php53-debuginfo-5.3.3-7.el5_8.x86_64.rpm php53-devel-5.3.3-7.el5_8.x86_64.rpm php53-gd-5.3.3-7.el5_8.x86_64.rpm php53-imap-5.3.3-7.el5_8.x86_64.rpm php53-intl-5.3.3-7.el5_8.x86_64.rpm php53-ldap-5.3.3-7.el5_8.x86_64.rpm php53-mbstring-5.3.3-7.el5_8.x86_64.rpm php53-mysql-5.3.3-7.el5_8.x86_64.rpm php53-odbc-5.3.3-7.el5_8.x86_64.rpm php53-pdo-5.3.3-7.el5_8.x86_64.rpm php53-pgsql-5.3.3-7.el5_8.x86_64.rpm php53-process-5.3.3-7.el5_8.x86_64.rpm php53-pspell-5.3.3-7.el5_8.x86_64.rpm php53-snmp-5.3.3-7.el5_8.x86_64.rpm php53-soap-5.3.3-7.el5_8.x86_64.rpm php53-xml-5.3.3-7.el5_8.x86_64.rpm php53-xmlrpc-5.3.3-7.el5_8.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://www.redhat.com/security/data/cve/CVE-2012-1823.html https://access.redhat.com/security/updates/classification/#critical 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2012 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD4DBQFPqBjQXlSAg2UNWIIRAsGqAJjy9MAGgtGKsuasY7QYQjdFM5yiAJ4xwgNF 6mLuYoKOaLGGEiAy1FU0OQ== =G9Kt -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2012-09-19-2 OS X Mountain Lion v10.8.2, OS X Lion v10.7.5 and Security Update 2012-004 OS X Mountain Lion v10.8.2, OS X Lion v10.7.5 and Security Update 2012-004 are now available and address the following: Apache Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: Multiple vulnerabilities in Apache Description: Apache is updated to version 2.2.22 to address several vulnerabilities, the most serious of which may lead to a denial of service. Further information is available via the Apache web site at http://httpd.apache.org/. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2011-3368 CVE-2011-3607 CVE-2011-4317 CVE-2012-0021 CVE-2012-0031 CVE-2012-0053 BIND Available for: OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: A remote attacker may be able to cause a denial of service in systems configured to run BIND as a DNS nameserver Description: A reachable assertion issue existed in the handling of DNS records. This issue was addressed by updating to BIND 9.7.6-P1. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2011-4313 BIND Available for: OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4, OS X Mountain Lion v10.8 and v10.8.1 Impact: A remote attacker may be able to cause a denial of service, data corruption, or obtain sensitive information from process memory in systems configured to run BIND as a DNS nameserver Description: A memory management issue existed in the handling of DNS records. This issue was addressed by updating to BIND 9.7.6-P1 on OS X Lion systems, and BIND 9.8.3-P1 on OS X Mountain Lion systems. CVE-ID CVE-2012-1667 CoreText Available for: OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: Applications that use CoreText may be vulnerable to an unexpected application termination or arbitrary code execution Description: A bounds checking issue existed in the handling of text glyphs, which may lead to out of bounds memory reads or writes. This issue was addressed through improved bounds checking. This issue does not affect Mac OS X v10.6 or OS X Mountain Lion systems. CVE-ID CVE-2012-3716 : Jesse Ruderman of Mozilla Corporation Data Security Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4, OS X Mountain Lion v10.8 and v10.8.1 Impact: An attacker with a privileged network position may intercept user credentials or other sensitive information Description: TrustWave, a trusted root CA, has issued, and subsequently revoked, a sub-CA certificate from one of its trusted anchors. This sub-CA facilitated the interception of communications secured by Transport Layer Security (TLS). This update adds the involved sub-CA certificate to OS X's list of untrusted certificates. DirectoryService Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8 Impact: If the DirectoryService Proxy is used, a remote attacker may cause a denial of service or arbitrary code execution Description: A buffer overflow existed in the DirectoryService Proxy. This issue was addressed through improved bounds checking. This issue does not affect OS X Lion and Mountain Lion systems. CVE-ID CVE-2012-0650 : aazubel working with HP's Zero Day Initiative ImageIO Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: Viewing a maliciously crafted PNG image may lead to an unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues existed in libpng's handling of PNG images. These issues were addressed through improved validation of PNG images. These issues do not affect OS X Mountain Lion systems. CVE-ID CVE-2011-3026 : Juri Aedla CVE-2011-3048 ImageIO Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: Viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution Description: An integer overflow issue existed in libTIFF's handling of TIFF images. This issue was addressed through improved validation of TIFF images. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2012-1173 : Alexander Gavrun working with HP's Zero Day Initiative Installer Available for: OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: Remote admins and persons with physical access to the system may obtain account information Description: The fix for CVE-2012-0652 in OS X Lion 10.7.4 prevented user passwords from being recorded in the system log, but did not remove the old log entries. This issue was addressed by deleting log files that contained passwords. This issue does not affect Mac OS X 10.6 or OS X Mountain Lion systems. CVE-ID CVE-2012-0652 International Components for Unicode Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: Applications that use ICU may be vulnerable to an unexpected application termination or arbitrary code execution Description: A stack buffer overflow existed in the handling of ICU locale IDs. This issue was addressed through improved bounds checking. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2011-4599 Kernel Available for: OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: A malicious program could bypass sandbox restrictions Description: A logic issue existed in the handling of debug system calls. This may allow a malicious program to gain code execution in other programs with the same user privileges. This issue was addressed by disabling handling of addresses in PT_STEP and PT_CONTINUE. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2012-0643 : iOS Jailbreak Dream Team LoginWindow Available for: OS X Mountain Lion v10.8 and v10.8.1 Impact: A local user may be able to obtain other user's login passwords Description: A user-installed input method could intercept password keystrokes from Login Window or Screen Saver Unlock. This issue was addressed by preventing user-installed methods from being used when the system is handling login information. CVE-ID CVE-2012-3718 : An anonymous researcher Mail Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: Viewing an e-mail message may lead to execution of web plugins Description: An input validation issue existed in Mail's handling of embedded web plugins. This issue was addressed by disabling third- party plug-ins in Mail. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2012-3719 : Will Dormann of the CERT/CC Mobile Accounts Available for: OS X Mountain Lion v10.8 and v10.8.1 Impact: A user with access to the contents of a mobile account may obtain the account password Description: Creating a mobile account saved a hash of the password in the account, which was used to login when the mobile account was used as an external account. The password hash could be used to determine the user's password. This issue was addressed by creating the password hash only if external accounts are enabled on the system where the mobile account is created. CVE-ID CVE-2012-3720 : Harald Wagener of Google, Inc. PHP Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4, OS X Mountain Lion v10.8 and v10.8.1 Impact: Multiple vulnerabilities in PHP Description: >PHP is updated to version 5.3.15 to address multiple vulnerabilities, the most serious of which may lead to arbitrary code execution. Further information is available via the PHP web site at http://www.php.net CVE-ID CVE-2012-0831 CVE-2012-1172 CVE-2012-1823 CVE-2012-2143 CVE-2012-2311 CVE-2012-2386 CVE-2012-2688 PHP Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: PHP scripts which use libpng may be vulnerable to an unexpected application termination or arbitrary code execution Description: A memory corruption issue existed in the handling of PNG files. This issue was addressed by updating PHP's copy of libpng to version 1.5.10. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2011-3048 Profile Manager Available for: OS X Lion Server v10.7 to v10.7.4 Impact: An unauthenticated user could enumerate managed devices Description: An authentication issue existed in the Device Management private interface. This issue was addressed by removing the interface. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2012-3721 : Derick Cassidy of XEquals Corporation QuickLook Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: Viewing a maliciously crafted .pict file may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue existed in the handling of .pict files. This issue was addressed through improved validation of .pict files. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2012-0671 : Rodrigo Rubira Branco (twitter.com/bsdaemon) from the Qualys Vulnerability & Malware Research Labs (VMRL) QuickTime Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution Description: An integer overflow existed in QuickTime's handling of sean atoms. This issue was addressed through improved bounds checking. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2012-0670 : Tom Gallagher (Microsoft) and Paul Bates (Microsoft) working with HP's Zero Day Initiative QuickTime Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution Description: An uninitialized memory access existed in the handling of Sorenson encoded movie files. This issue was addressed through improved memory initialization. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2012-3722 : Will Dormann of the CERT/CC QuickTime Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow existed in the handling of RLE encoded movie files. This issue was addressed through improved bounds checking. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2012-0668 : Luigi Auriemma working with HP's Zero Day Initiative Ruby Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: An attacker may be able to decrypt data protected by SSL Description: There are known attacks on the confidentiality of SSL 3.0 and TLS 1.0 when a cipher suite uses a block cipher in CBC mode. The Ruby OpenSSL module disabled the 'empty fragment' countermeasure which prevented these attacks. This issue was addressed by enabling empty fragments. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2011-3389 USB Available for: OS X Lion v10.7 to v10.7.4, OS X Lion Server v10.7 to v10.7.4 Impact: Attaching a USB device may lead to an unexpected system termination or arbitrary code execution Description: A memory corruption issue existed in the handling of USB hub descriptors. This issue was addressed through improved handling of the bNbrPorts descriptor field. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2012-3723 : Andy Davis of NGS Secure Note: OS X Mountain Lion v10.8.2 includes the content of Safari 6.0.1. For further details see "About the security content of Safari 6.0.1" at http://http//support.apple.com/kb/HT5502 OS X Mountain Lion v10.8.2, OS X Lion v10.7.5 and Security Update 2012-004 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ The Software Update utility will present the update that applies to your system configuration. Only one is needed, either OS X Mountain Lion v10.8.2, OS X Lion v10.7.5 or Security Update 2012-004. For OS X Mountain Lion v10.8.1 The download file is named: OSXUpd10.8.2.dmg Its SHA-1 digest is: d6779e1cc748b78af0207499383b1859ffbebe33 For OS X Mountain Lion v10.8 The download file is named: OSXUpdCombo10.8.2.dmg Its SHA-1 digest is: b08f10233d362e39f20b69f91d1d73f5e7b68a2c For OS X Lion v10.7.4 The download file is named: MacOSXUpd10.7.5.dmg Its SHA-1 digest is: e0a9582cce9896938a7a541bd431862d93893532 For OS X Lion v10.7 and v10.7.3 The download file is named: MacOSXUpdCombo10.7.5.dmg Its SHA-1 digest is: f7a26b164fa10dae4fe646e57b01c34a619c8d9b For OS X Lion Server v10.7.4 The download file is named: MacOSXServerUpd10.7.5.dmg Its SHA-1 digest is: a891b03bfb4eecb745c0c39a32f39960fdb6796a For OS X Lion Server v10.7 and v10.7.3 The download file is named: MacOSXServerUpdCombo10.7.5.dmg Its SHA-1 digest is: df6e1748ab0a3c9e05c890be49d514673efd965e For Mac OS X v10.6.8 The download file is named: SecUpd2012-004.dmg Its SHA-1 digest is: 5b136e29a871d41012f0c6ea1362d6210c8b4fb7 For Mac OS X Server v10.6.8 The download file is named: SecUpdSrvr2012-004.dmg Its SHA-1 digest is: 9b24496be15078e58a88537700f2f39c112e3b28 Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJQWhlbAAoJEPefwLHPlZEwwjwQAKrpQlZh1B2mkSTLxR7QZg6e Qm7SmIZL9sjl5gQkTxoAvOGxJ8uRdYPlJ1IpyU/MbK0GqO53KmFSeKkwCnvLKMaW pc6tiFaQ4zV4LEAwBAFEuqCsMyPEJqKDhYXl2cHQmWfAlrLCyCKfzGLy2mY2UnkE DQC2+ys70DChFv2GzyXlibBXAGMKDygJ5dVKynsi1ceZLYWbUJoGwlUtXPylBpnO QyGWXmEloPbhK6HJbKMNacuDdVcb26pvIeFiivkTSxPVlZ3ns2tAwEyvHrzA9O4n 7rQ6jvfDbguOZmM5sPFvVKBw2GVDBNU+G3T8ouIXhk6Pjhr4in8VFCb8MIMLb8hm 7YYn2z1TzKTNmUuYbwe6ukQvf57cPuW0bAvslbl6PgrzqorlNPU4rDoSvPrJx/RO BOYkcxfirevHDGibfkeqXPjL3h+bVrb1USZpAv+ZOAy0M89SHFcvMtpAhxnoGiV5 w4EyKB+9Yi/CSAk2Ne3Y5kHH7/v3pWV68aJwhVirya7ex3vnJ+M+lRLKSm2BUjL3 +9fykrJBDujFDXoCmK5CN5Wx36DSVZ4VO1h635crotudtcvd+LQ2VHma/Chav5wK q5SSllf4KEownpx6o/qTxpg5tcC4lvgTcsDHlYcNq2s8KTTjmOden8ar4h7M7QD2 xyBfrQfG/dsif6jGHaot =8joH -----END PGP SIGNATURE----- . Content-Disposition: inline ==========================================================================Ubuntu Security Notice USN-1437-1 May 04, 2012 php5 vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 12.04 LTS - Ubuntu 11.10 - Ubuntu 11.04 - Ubuntu 10.04 LTS - Ubuntu 8.04 LTS Summary: Standalone PHP CGI scripts could be made to execute arbitrary code with the privilege of the web server. Configurations using mod_php5 and FastCGI were not vulnerable. Please see http://people.canonical.com/~ubuntu-security/cve/2012/CVE-2012-2311.html for more details and potential mitigation approaches. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 12.04 LTS: php5-cgi 5.3.10-1ubuntu3.1 Ubuntu 11.10: php5-cgi 5.3.6-13ubuntu3.7 Ubuntu 11.04: php5-cgi 5.3.5-1ubuntu7.8 Ubuntu 10.04 LTS: php5-cgi 5.3.2-1ubuntu4.15 Ubuntu 8.04 LTS: php5-cgi 5.2.4-2ubuntu5.24 In general, a standard system update will make all the necessary changes

Trust: 2.25

sources: NVD: CVE-2012-1823 // BID: 53388 // VULMON: CVE-2012-1823 // PACKETSTORM: 112465 // PACKETSTORM: 112631 // PACKETSTORM: 121573 // PACKETSTORM: 114272 // PACKETSTORM: 112580 // PACKETSTORM: 113905 // PACKETSTORM: 112606 // PACKETSTORM: 112612 // PACKETSTORM: 112508 // PACKETSTORM: 116792 // PACKETSTORM: 112474

AFFECTED PRODUCTS

vendor:phpmodel:phpscope:ltversion:5.4.2

Trust: 1.0

vendor:fedoraprojectmodel:fedorascope:eqversion:40

Trust: 1.0

vendor:redhatmodel:enterprise linux eusscope:eqversion:6.1

Trust: 1.0

vendor:redhatmodel:enterprise linux workstationscope:eqversion:6.0

Trust: 1.0

vendor:redhatmodel:application stackscope:eqversion:2.0

Trust: 1.0

vendor:redhatmodel:gluster storage server for on-premisescope:eqversion:2.0

Trust: 1.0

vendor:redhatmodel:enterprise linux workstationscope:eqversion:5.0

Trust: 1.0

vendor:hpmodel:hp-uxscope:eqversion:b.11.31

Trust: 1.0

vendor:redhatmodel:storage for public cloudscope:eqversion:2.0

Trust: 1.0

vendor:redhatmodel:enterprise linux serverscope:eqversion:5.0

Trust: 1.0

vendor:opensusemodel:opensusescope:eqversion:12.1

Trust: 1.0

vendor:applemodel:mac os xscope:gteversion:10.8.0

Trust: 1.0

vendor:redhatmodel:enterprise linux desktopscope:eqversion:6.0

Trust: 1.0

vendor:susemodel:linux enterprise software development kitscope:eqversion:11

Trust: 1.0

vendor:opensusemodel:opensusescope:eqversion:11.4

Trust: 1.0

vendor:hpmodel:hp-uxscope:eqversion:b.11.23

Trust: 1.0

vendor:redhatmodel:storagescope:eqversion:2.0

Trust: 1.0

vendor:phpmodel:phpscope:gteversion:5.4.0

Trust: 1.0

vendor:redhatmodel:enterprise linux eusscope:eqversion:5.6

Trust: 1.0

vendor:fedoraprojectmodel:fedorascope:eqversion:39

Trust: 1.0

vendor:susemodel:linux enterprise software development kitscope:eqversion:10

Trust: 1.0

vendor:redhatmodel:enterprise linux eusscope:eqversion:6.2

Trust: 1.0

vendor:applemodel:mac os xscope:ltversion:10.7.5

Trust: 1.0

vendor:susemodel:linux enterprise serverscope:eqversion:11

Trust: 1.0

vendor:redhatmodel:enterprise linux serverscope:eqversion:6.0

Trust: 1.0

vendor:phpmodel:phpscope:ltversion:5.3.12

Trust: 1.0

vendor:applemodel:mac os xscope:ltversion:10.8.2

Trust: 1.0

vendor:applemodel:mac os xscope:gteversion:10.6.8

Trust: 1.0

vendor:debianmodel:linuxscope:eqversion:6.0

Trust: 1.0

vendor:susemodel:linux enterprise serverscope:eqversion:10

Trust: 1.0

vendor:redhatmodel:enterprise linux server ausscope:eqversion:5.3

Trust: 1.0

vendor:redhatmodel:enterprise linux server ausscope:eqversion:5.6

Trust: 1.0

vendor:phpmodel:phpscope:eqversion:5.3.1

Trust: 0.9

vendor:phpmodel:phpscope:eqversion:5.2.16

Trust: 0.6

vendor:phpmodel:phpscope:eqversion:5.3.0

Trust: 0.6

vendor:phpmodel:phpscope:eqversion:5.2.15

Trust: 0.6

vendor:phpmodel:phpscope:eqversion:5.2.8

Trust: 0.6

vendor:phpmodel:phpscope:eqversion:5.2.13

Trust: 0.6

vendor:phpmodel:phpscope:eqversion:5.2.17

Trust: 0.6

vendor:phpmodel:phpscope:eqversion:5.2.14

Trust: 0.6

vendor:phpmodel:phpscope:eqversion:5.2.11

Trust: 0.6

vendor:phpmodel:phpscope:eqversion:5.2.12

Trust: 0.6

vendor:parallelsmodel:plesk panelscope:eqversion:9.5.4

Trust: 0.3

vendor:ubuntumodel:linux i386scope:eqversion:11.10

Trust: 0.3

vendor:hpmodel:system management homepagescope:eqversion:6.2

Trust: 0.3

vendor:redhatmodel:enterprise linux hpc node optionalscope:eqversion:6

Trust: 0.3

vendor:hpmodel:system management homepagescope:eqversion:7.2

Trust: 0.3

vendor:debianmodel:linux armscope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux ia-64scope:eqversion:6.0

Trust: 0.3

vendor:avayamodel:ip office application serverscope:eqversion:8.1

Trust: 0.3

vendor:oraclemodel:enterprise linuxscope:eqversion:6.2

Trust: 0.3

vendor:avayamodel:voice portal sp1scope:eqversion:5.0

Trust: 0.3

vendor:redhatmodel:enterprise linux serverscope:eqversion:6

Trust: 0.3

vendor:phpmodel:phpscope:eqversion:5.3.8

Trust: 0.3

vendor:susemodel:linux enterprise sdk sp1scope:eqversion:11

Trust: 0.3

vendor:avayamodel:voice portalscope:eqversion:5.1

Trust: 0.3

vendor:susemodel:linux enterprise server sp3 ltssscope:eqversion:10

Trust: 0.3

vendor:avayamodel:aura application enablement servicesscope:eqversion:5.2

Trust: 0.3

vendor:oraclemodel:enterprise linuxscope:eqversion:5

Trust: 0.3

vendor:redhatmodel:enterprise linux server eus 6.1.zscope: - version: -

Trust: 0.3

vendor:redhatmodel:enterprise linux server optionalscope:eqversion:6

Trust: 0.3

vendor:redhatmodel:enterprise linux long life serverscope:eqversion:5.3

Trust: 0.3

vendor:turbolinuxmodel:appliance serverscope:eqversion:3.0

Trust: 0.3

vendor:avayamodel:aura application enablement servicesscope:eqversion:5.2.3

Trust: 0.3

vendor:mandrakesoftmodel:enterprise serverscope:eqversion:5

Trust: 0.3

vendor:phpmodel:phpscope:eqversion:5.3.10

Trust: 0.3

vendor:avayamodel:voice portal sp2scope:eqversion:5.0

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.7

Trust: 0.3

vendor:junipermodel:ctpviewscope:eqversion:4.6

Trust: 0.3

vendor:avayamodel:aura application enablement servicesscope:eqversion:6.1

Trust: 0.3

vendor:ubuntumodel:linux amd64scope:eqversion:11.10

Trust: 0.3

vendor:hpmodel:system management homepagescope:eqversion:7.0

Trust: 0.3

vendor:avayamodel:aura application enablement servicesscope:eqversion:6.1.1

Trust: 0.3

vendor:avayamodel:aura communication manager utility servicesscope:eqversion:6.1

Trust: 0.3

vendor:ubuntumodel:linux lts amd64scope:eqversion:8.04

Trust: 0.3

vendor:mandrivamodel:linux mandrake x86 64scope:eqversion:2011

Trust: 0.3

vendor:redhatmodel:enterprise linux workstationscope:eqversion:6

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.6.8

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.7.5

Trust: 0.3

vendor:ubuntumodel:linux lts powerpcscope:eqversion:8.04

Trust: 0.3

vendor:ubuntumodel:linux amd64scope:eqversion:10.04

Trust: 0.3

vendor:junipermodel:ctpviewscope:eqversion:4.3

Trust: 0.3

vendor:avayamodel:aura messagingscope:eqversion:6.0.1

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.7.3

Trust: 0.3

vendor:susemodel:linux enterprise sdk sp4scope:eqversion:10

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.7.4

Trust: 0.3

vendor:junipermodel:ctpviewscope:eqversion:4.2

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.8

Trust: 0.3

vendor:s u s emodel:opensusescope:eqversion:11.4

Trust: 0.3

vendor:ubuntumodel:linux amd64scope:eqversion:11.04

Trust: 0.3

vendor:redhatmodel:enterprise linux workstation optionalscope:eqversion:6

Trust: 0.3

vendor:avayamodel:voice portalscope:eqversion:5.1.1

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.8.1

Trust: 0.3

vendor:ubuntumodel:linux i386scope:eqversion:10.04

Trust: 0.3

vendor:avayamodel:aura communication managerscope:eqversion:6.0

Trust: 0.3

vendor:parallelsmodel:plesk panelscope:eqversion:9.3

Trust: 0.3

vendor:ubuntumodel:linux lts sparcscope:eqversion:8.04

Trust: 0.3

vendor:debianmodel:linux sparcscope:eqversion:6.0

Trust: 0.3

vendor:junipermodel:ctpview 7.0r1scope:neversion: -

Trust: 0.3

vendor:ibmmodel:lotus foundations start 1.2.2bscope:neversion: -

Trust: 0.3

vendor:phpmodel:phpscope:eqversion:5.3.9

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.7.1

Trust: 0.3

vendor:hpmodel:system management homepagescope:eqversion:6.1

Trust: 0.3

vendor:avayamodel:aura messagingscope:eqversion:6.1

Trust: 0.3

vendor:ubuntumodel:linux lts i386scope:eqversion:8.04

Trust: 0.3

vendor:ubuntumodel:linux i386scope:eqversion:11.04

Trust: 0.3

vendor:avayamodel:aura application enablement servicesscope:eqversion:5.2.2

Trust: 0.3

vendor:redhatmodel:enterprise linux eus 5.6.z serverscope: - version: -

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.7.2

Trust: 0.3

vendor:hpmodel:system management homepagescope:neversion:7.2.1

Trust: 0.3

vendor:susemodel:linux enterprise server sp1scope:eqversion:11

Trust: 0.3

vendor:avayamodel:aura session manager sp1scope:eqversion:5.2

Trust: 0.3

vendor:phpmodel:phpscope:eqversion:5.4.2

Trust: 0.3

vendor:susemodel:linux enterprise server sp4scope:eqversion:10

Trust: 0.3

vendor:avayamodel:ip office application serverscope:eqversion:6.1

Trust: 0.3

vendor:oraclemodel:enterprise linuxscope:eqversion:6

Trust: 0.3

vendor:ibmmodel:lotus foundations start 1.2.2ascope: - version: -

Trust: 0.3

vendor:applemodel:mac osscope:neversion:x10.7.5

Trust: 0.3

vendor:junipermodel:ctpviewscope:eqversion:4.5

Trust: 0.3

vendor:avayamodel:aura application enablement servicesscope:eqversion:5.2.1

Trust: 0.3

vendor:ubuntumodel:linux sparcscope:eqversion:10.04

Trust: 0.3

vendor:redhatmodel:enterprise linux desktop optionalscope:eqversion:6

Trust: 0.3

vendor:avayamodel:aura communication manager utility servicesscope:eqversion:6.0

Trust: 0.3

vendor:mandrivamodel:linux mandrake x86 64scope:eqversion:2010.1

Trust: 0.3

vendor:avayamodel:voice portal sp1scope:eqversion:5.1

Trust: 0.3

vendor:phpmodel:phpscope:eqversion:5.3.3

Trust: 0.3

vendor:susemodel:linux enterprise server sp2scope:eqversion:11

Trust: 0.3

vendor:avayamodel:voice portalscope:eqversion:5.1.2

Trust: 0.3

vendor:avayamodel:ip office application serverscope:eqversion:7.0

Trust: 0.3

vendor:gentoomodel:linuxscope: - version: -

Trust: 0.3

vendor:susemodel:linux enterprise sdk sp2scope:eqversion:11

Trust: 0.3

vendor:ubuntumodel:linux powerpcscope:eqversion:10.04

Trust: 0.3

vendor:redhatmodel:enterprise linux server optional eusscope:eqversion:6.1

Trust: 0.3

vendor:ubuntumodel:linux lts i386scope:eqversion:12.04

Trust: 0.3

vendor:redhatmodel:enterprise linux hpc nodescope:eqversion:6

Trust: 0.3

vendor:phpmodel:phpscope:eqversion:5.3.6

Trust: 0.3

vendor:phpmodel:phpscope:eqversion:5.3.5

Trust: 0.3

vendor:debianmodel:linux amd64scope:eqversion:6.0

Trust: 0.3

vendor:avayamodel:aura communication managerscope:eqversion:6.0.1

Trust: 0.3

vendor:turbolinuxmodel:serverscope:eqversion:110

Trust: 0.3

vendor:avayamodel:voice portalscope:eqversion:5.0

Trust: 0.3

vendor:avayamodel:aura session managerscope:eqversion:5.2

Trust: 0.3

vendor:avayamodel:ip office application serverscope:eqversion:8.0

Trust: 0.3

vendor:phpmodel:phpscope:eqversion:5.3.4

Trust: 0.3

vendor:mandrivamodel:linux mandrakescope:eqversion:2011

Trust: 0.3

vendor:ubuntumodel:linux lts lpiascope:eqversion:8.04

Trust: 0.3

vendor:ubuntumodel:linux armscope:eqversion:10.04

Trust: 0.3

vendor:ubuntumodel:linux powerpcscope:eqversion:11.04

Trust: 0.3

vendor:phpmodel:phpscope:eqversion:5.3.12

Trust: 0.3

vendor:junipermodel:ctpviewscope:eqversion:4.4

Trust: 0.3

vendor:redhatmodel:enterprise linux serverscope:eqversion:5

Trust: 0.3

vendor:ubuntumodel:linux lts amd64scope:eqversion:12.04

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.7

Trust: 0.3

vendor:debianmodel:linux ia-32scope:eqversion:6.0

Trust: 0.3

vendor:phpmodel:phpscope:eqversion:5.3.7

Trust: 0.3

vendor:debianmodel:linux mipsscope:eqversion:6.0

Trust: 0.3

vendor:ubuntumodel:linux armscope:eqversion:11.04

Trust: 0.3

vendor:hpmodel:system management homepagescope:eqversion:6.0

Trust: 0.3

vendor:avayamodel:aura messagingscope:eqversion:6.0

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.6.8

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.7.3

Trust: 0.3

vendor:susemodel:linux enterprise server for vmware sp1scope:eqversion:11

Trust: 0.3

vendor:hpmodel:system management homepagescope:eqversion:7.1.2

Trust: 0.3

vendor:applemodel:mac osscope:neversion:x10.8.2

Trust: 0.3

vendor:susemodel:linux enterprise server for vmware sp2scope:eqversion:11

Trust: 0.3

vendor:hpmodel:hp-ux b.11.31scope: - version: -

Trust: 0.3

vendor:debianmodel:linux s/390scope:eqversion:6.0

Trust: 0.3

vendor:avayamodel:aura communication manager utility servicesscope:eqversion:6.2

Trust: 0.3

vendor:turbolinuxmodel:appliance serverscope:eqversion:3.0x64

Trust: 0.3

vendor:redhatmodel:enterprise linux desktop workstation clientscope:eqversion:5

Trust: 0.3

vendor:parallelsmodel:plesk panelscope:eqversion:9.2

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.7.1

Trust: 0.3

vendor:phpmodel:phpscope:eqversion:5.4.1

Trust: 0.3

vendor:debianmodel:linux powerpcscope:eqversion:6.0

Trust: 0.3

vendor:turbolinuxmodel:clientscope:eqversion:2008

Trust: 0.3

vendor:parallelsmodel:plesk panelscope:eqversion:8.6

Trust: 0.3

vendor:parallelsmodel:plesk panelscope:eqversion:9.0

Trust: 0.3

vendor:avayamodel:ip office application serverscope:eqversion:6.0

Trust: 0.3

vendor:hpmodel:system management homepagescope:eqversion:6.3

Trust: 0.3

vendor:ibmmodel:lotus foundations startscope:eqversion:1.2

Trust: 0.3

vendor:hpmodel:system management homepagescope:eqversion:7.1.1

Trust: 0.3

vendor:mandrakesoftmodel:enterprise server x86 64scope:eqversion:5

Trust: 0.3

vendor:hpmodel:system management homepagescope:eqversion:7.1

Trust: 0.3

vendor:redhatmodel:enterprise linux server eusscope:eqversion:6.0

Trust: 0.3

vendor:avayamodel:aura session manager sp2scope:eqversion:5.2

Trust: 0.3

vendor:turbolinuxmodel:serverscope:eqversion:11x64

Trust: 0.3

vendor:hpmodel:system management homepagescope:neversion:7.1.1

Trust: 0.3

vendor:redhatmodel:enterprise linux server optional eusscope:eqversion:6.0

Trust: 0.3

vendor:s u s emodel:opensusescope:eqversion:12.1

Trust: 0.3

vendor:phpmodel:phpscope:eqversion:5.3.2

Trust: 0.3

vendor:applemodel:mac os serverscope:eqversion:x10.7.2

Trust: 0.3

vendor:mandrivamodel:linux mandrakescope:eqversion:2010.1

Trust: 0.3

vendor:phpmodel:phpscope:neversion:5.3.13

Trust: 0.3

sources: BID: 53388 // CNNVD: CNNVD-201205-108 // NVD: CVE-2012-1823

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2012-1823
value: CRITICAL

Trust: 1.0

CNNVD: CNNVD-201205-108
value: HIGH

Trust: 0.6

VULMON: CVE-2012-1823
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2012-1823
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

nvd@nist.gov: CVE-2012-1823
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

sources: VULMON: CVE-2012-1823 // CNNVD: CNNVD-201205-108 // NVD: CVE-2012-1823

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

sources: NVD: CVE-2012-1823

THREAT TYPE

remote

Trust: 1.0

sources: PACKETSTORM: 112631 // PACKETSTORM: 112606 // PACKETSTORM: 112508 // PACKETSTORM: 112474 // CNNVD: CNNVD-201205-108

TYPE

input validation

Trust: 0.6

sources: CNNVD: CNNVD-201205-108

EXPLOIT AVAILABILITY

sources: VULMON: CVE-2012-1823

PATCH

title:PHP 5.4.3url:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=43186

Trust: 0.6

title:PHP 5.4.3url:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=43185

Trust: 0.6

title:Red Hat: Critical: php53 security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20120569 - Security Advisory

Trust: 0.1

title:Red Hat: Critical: php security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20120568 - Security Advisory

Trust: 0.1

title:Red Hat: Critical: php security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20120546 - Security Advisory

Trust: 0.1

title:Red Hat: Critical: php53 security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20120547 - Security Advisory

Trust: 0.1

title:Debian CVElist Bug Report Logs: php5: PHP-CGI query string parameter vulnerability (CVE-2012-1823 / CVE-2012-2311, CERT VU#520827)url:https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs&qid=369fec60ba7ae134a5d768faf3cb2f6b

Trust: 0.1

title:Ubuntu Security Notice: php5 vulnerabilityurl:https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice&qid=USN-1437-1

Trust: 0.1

title:Amazon Linux AMI: ALAS-2012-077url:https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami&qid=ALAS-2012-077

Trust: 0.1

title:Debian Security Advisories: DSA-2465-1 php5 -- several vulnerabilitiesurl:https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories&qid=db88513c75df4c41339c6c90dcb69831

Trust: 0.1

title:Red Hat: Moderate: php security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20121045 - Security Advisory

Trust: 0.1

title:Red Hat: Moderate: php53 security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20121047 - Security Advisory

Trust: 0.1

title:Red Hat: Moderate: php security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20121046 - Security Advisory

Trust: 0.1

title:HacktivityCon_CTF_2020url:https://github.com/W3rni0/HacktivityCon_CTF_2020

Trust: 0.1

title:exploitsurl:https://github.com/infodox/exploits

Trust: 0.1

title:webappurlsurl:https://github.com/pwnwiki/webappurls

Trust: 0.1

title:CVE-2012-1823url:https://github.com/drone789/CVE-2012-1823

Trust: 0.1

title:Covid-v2-Botneturl:https://github.com/SniperX-D/Covid-v2-Botnet

Trust: 0.1

title:covidurl:https://github.com/MrScytheLULZ/covid

Trust: 0.1

title:python-pySecurityurl:https://github.com/CyberSavvy/python-pySecurity

Trust: 0.1

title:pySecurityurl:https://github.com/smartFlash/pySecurity

Trust: 0.1

title:AutoSploiturl:https://github.com/RootUp/AutoSploit

Trust: 0.1

title:Pythonurl:https://github.com/BCyberSavvy/Python

Trust: 0.1

title:awesome-infosecurl:https://github.com/onlurking/awesome-infosec

Trust: 0.1

title:awesome-infosecurl:https://github.com/eric-erki/awesome-infosec

Trust: 0.1

title:Intrusion_Detection_System-Pythonurl:https://github.com/marcocastro100/Intrusion_Detection_System-Python

Trust: 0.1

title:deepdigurl:https://github.com/cyberdeception/deepdig

Trust: 0.1

title:Boot2root-CTFs-Writeupsurl:https://github.com/Jean-Francois-C/Boot2root-CTFs

Trust: 0.1

title:Boot2root-CTFs-Writeupsurl:https://github.com/Jean-Francois-C/Boot2root-CTFs-Writeups

Trust: 0.1

title:CDLurl:https://github.com/NCSU-DANCE-Research-Group/CDL

Trust: 0.1

title:Classified-Distributed-Learning-for-Detecting-Security-Attacks-in-Containerized-Applicationsurl:https://github.com/yuhang-lin/Classified-Distributed-Learning-for-Detecting-Security-Attacks-in-Containerized-Applications

Trust: 0.1

title:Threatposturl:https://threatpost.com/new-exploits-arrive-for-old-php-vulnerability/104881/

Trust: 0.1

title:Securelisturl:https://securelist.com/it-threat-evolution-q2-2013/37163/

Trust: 0.1

title:Threatposturl:https://threatpost.com/php-group-set-release-another-patch-cve-2012-1823-flaw-050812/76537/

Trust: 0.1

title:Threatposturl:https://threatpost.com/php-group-releases-new-versions-patch-doesnt-fix-cve-2012-1823-bug-050412/76524/

Trust: 0.1

sources: VULMON: CVE-2012-1823 // CNNVD: CNNVD-201205-108

EXTERNAL IDS

db:NVDid:CVE-2012-1823

Trust: 3.0

db:CERT/CCid:VU#520827

Trust: 2.1

db:SECUNIAid:49014

Trust: 2.0

db:SECUNIAid:49065

Trust: 1.7

db:SECUNIAid:49085

Trust: 1.7

db:SECUNIAid:49087

Trust: 1.7

db:CERT/CCid:VU#673343

Trust: 1.4

db:SECTRACKid:1027022

Trust: 1.1

db:OPENWALLid:OSS-SECURITY/2024/06/07/1

Trust: 1.0

db:SECUNIAid:49053

Trust: 0.7

db:SECUNIAid:49097

Trust: 0.6

db:CNNVDid:CNNVD-201205-108

Trust: 0.6

db:JUNIPERid:JSA10658

Trust: 0.3

db:BIDid:53388

Trust: 0.3

db:EXPLOIT-DBid:18836

Trust: 0.1

db:VULMONid:CVE-2012-1823

Trust: 0.1

db:PACKETSTORMid:112465

Trust: 0.1

db:PACKETSTORMid:112631

Trust: 0.1

db:PACKETSTORMid:121573

Trust: 0.1

db:PACKETSTORMid:114272

Trust: 0.1

db:PACKETSTORMid:112580

Trust: 0.1

db:PACKETSTORMid:113905

Trust: 0.1

db:PACKETSTORMid:112606

Trust: 0.1

db:PACKETSTORMid:112612

Trust: 0.1

db:PACKETSTORMid:112508

Trust: 0.1

db:PACKETSTORMid:116792

Trust: 0.1

db:PACKETSTORMid:112474

Trust: 0.1

sources: VULMON: CVE-2012-1823 // BID: 53388 // PACKETSTORM: 112465 // PACKETSTORM: 112631 // PACKETSTORM: 121573 // PACKETSTORM: 114272 // PACKETSTORM: 112580 // PACKETSTORM: 113905 // PACKETSTORM: 112606 // PACKETSTORM: 112612 // PACKETSTORM: 112508 // PACKETSTORM: 116792 // PACKETSTORM: 112474 // CNNVD: CNNVD-201205-108 // NVD: CVE-2012-1823

REFERENCES

url:http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/

Trust: 2.1

url:http://www.kb.cert.org/vuls/id/520827

Trust: 2.1

url:http://www.php.net/archive/2012.php#id2012-05-03-1

Trust: 2.0

url:https://bugs.php.net/bug.php?id=61910

Trust: 1.8

url:http://www.php.net/changelog-5.php#5.4.2

Trust: 1.7

url:https://bugs.php.net/patch-display.php?bug_id=61910&patch=cgi.diff&revision=1335984315&display=1

Trust: 1.7

url:http://secunia.com/advisories/49014

Trust: 1.7

url:http://secunia.com/advisories/49087

Trust: 1.7

url:http://secunia.com/advisories/49065

Trust: 1.7

url:http://secunia.com/advisories/49085

Trust: 1.7

url:http://www.kb.cert.org/vuls/id/673343

Trust: 1.5

url:http://h20000.www2.hp.com/bizsupport/techsupport/document.jsp?objectid=c03360041

Trust: 1.4

url:http://rhn.redhat.com/errata/rhsa-2012-0547.html

Trust: 1.2

url:http://rhn.redhat.com/errata/rhsa-2012-0570.html

Trust: 1.2

url:http://rhn.redhat.com/errata/rhsa-2012-0569.html

Trust: 1.2

url:http://www.debian.org/security/2012/dsa-2465

Trust: 1.2

url:http://rhn.redhat.com/errata/rhsa-2012-0568.html

Trust: 1.1

url:http://rhn.redhat.com/errata/rhsa-2012-0546.html

Trust: 1.1

url:http://marc.info/?l=bugtraq&m=134012830914727&w=2

Trust: 1.1

url:http://lists.apple.com/archives/security-announce/2012/sep/msg00004.html

Trust: 1.1

url:http://support.apple.com/kb/ht5501

Trust: 1.1

url:http://www.securitytracker.com/id?1027022

Trust: 1.1

url:http://www.mandriva.com/security/advisories?name=mdvsa-2012:068

Trust: 1.1

url:http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00002.html

Trust: 1.1

url:http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00011.html

Trust: 1.1

url:http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00007.html

Trust: 1.1

url:http://www.openwall.com/lists/oss-security/2024/06/07/1

Trust: 1.0

url:https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/pkgtquoa2ntz3rxn22csaujpiruyrb4b/

Trust: 1.0

url:https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/w45dboh56nqdrtom2dn2lna2fzimc3pk/

Trust: 1.0

url:https://nvd.nist.gov/vuln/detail/cve-2012-1823

Trust: 0.9

url:https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c03839862

Trust: 0.6

url:http://secunia.com/advisories/49053

Trust: 0.6

url:http://secunia.com/advisories/49097

Trust: 0.6

url:https://nvd.nist.gov/vuln/detail/cve-2012-2311

Trust: 0.4

url:http://alerts.hp.com/r?2.1.3kt.2zr.xg7ek.hmj%2asm..t.a4jy.6o9k.bw89mq%5f%5fdmtsfto0

Trust: 0.3

url:http://www-01.ibm.com/software/lotus/products/foundations/start/

Trust: 0.3

url:http://kb.parallels.com/en/113818

Trust: 0.3

url:kb.parallels.com/en/116241

Trust: 0.3

url:https://community.rapid7.com/thread/5174

Trust: 0.3

url:http://www.php.net/

Trust: 0.3

url:http://seclists.org/fulldisclosure/2013/jun/21

Trust: 0.3

url:http://ompldr.org/vzgxxaq

Trust: 0.3

url:http://kb.juniper.net/infocenter/index?page=content&id=jsa10658&cat=sirt_1&actp=list

Trust: 0.3

url:https://downloads.avaya.com/css/p8/documents/100162699

Trust: 0.3

url:https://downloads.avaya.com/css/p8/documents/100165255

Trust: 0.3

url:http://www.h-online.com/security/news/item/critical-open-hole-in-php-creates-risks-update-1567532.html

Trust: 0.3

url:http://www-01.ibm.com/support/docview.wss?uid=swg21620314

Trust: 0.3

url:http://www.turbolinux.co.jp/security-e/2012/tlsa-2012-14.txt

Trust: 0.3

url:https://www.redhat.com/security/data/cve/cve-2012-1823.html

Trust: 0.3

url:https://www.redhat.com/mailman/listinfo/rhsa-announce

Trust: 0.3

url:https://access.redhat.com/security/team/contact/

Trust: 0.3

url:https://access.redhat.com/security/team/key/#package

Trust: 0.3

url:https://access.redhat.com/security/updates/classification/#critical

Trust: 0.3

url:http://bugzilla.redhat.com/):

Trust: 0.3

url:https://access.redhat.com/knowledge/articles/11258

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2012-0031

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2011-4317

Trust: 0.3

url:http://h20566.www2.hp.com/portal/site/hpsc/public/kb/secbullarchive/

Trust: 0.3

url:http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2012-0830

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2011-4153

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2011-3607

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2012-0021

Trust: 0.3

url:https://h20566.www2.hp.com/portal/site/hpsc/public/kb/

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2012-0053

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2012-1172

Trust: 0.3

url:http://secunia.com/psi_30_beta_launch

Trust: 0.2

url:http://secunia.com/vulnerability_intelligence/

Trust: 0.2

url:http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/

Trust: 0.2

url:http://secunia.com/advisories/secunia_security_advisories/

Trust: 0.2

url:http://secunia.com/advisories/about_secunia_advisories/

Trust: 0.2

url:http://secunia.com/vulnerability_scanning/personal/

Trust: 0.2

url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2012-0036

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2012-2016

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2012-0057

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2011-4078

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2012-1165

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2011-4885

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2011-2834

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2011-1944

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2012-2014

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2011-4108

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2012-2013

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2011-4415

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2011-4577

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2011-4619

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2012-0027

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2012-2012

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2012-2015

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2011-3379

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2011-4576

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2011-2821

Trust: 0.2

url:https://cwe.mitre.org/data/definitions/20.html

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2012:0569

Trust: 0.1

url:https://github.com/infodox/exploits

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://www.exploit-db.com/exploits/18836/

Trust: 0.1

url:http://secunia.com/advisories/49014/#comments

Trust: 0.1

url:https://ca.secunia.com/?page=viewadvisory&vuln_id=49014

Trust: 0.1

url:http://secunia.com/advisories/49014/

Trust: 0.1

url:http://www.hp.com/swpublishing/mtx-ac3d1f80b8dd48b792bfc01a08

Trust: 0.1

url:http://h20566.www2.hp.com/portal/site/hpsc/template.page/public/psi/swddetail

Trust: 0.1

url:http://secunia.com/

Trust: 0.1

url:http://www.debian.org/security/faq

Trust: 0.1

url:http://www.debian.org/security/

Trust: 0.1

url:http://lists.grok.org.uk/full-disclosure-charter.html

Trust: 0.1

url:http://software.hp.com

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2012-0883

Trust: 0.1

url:https://www.hp.com/go/swa

Trust: 0.1

url:http://secunia.com/advisories/49053/

Trust: 0.1

url:https://ca.secunia.com/?page=viewadvisory&vuln_id=49053

Trust: 0.1

url:http://secunia.com/advisories/49053/#comments

Trust: 0.1

url:http://www.php.net

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2012-2688

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2012-3718

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2011-4313

Trust: 0.1

url:http://http//support.apple.com/kb/ht5502

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2011-3048

Trust: 0.1

url:http://support.apple.com/kb/ht1222

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2012-0668

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2011-3368

Trust: 0.1

url:http://www.apple.com/support/downloads/

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2012-0831

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2012-0670

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2012-0671

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2012-1173

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2012-2143

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2012-0652

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2011-4599

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2011-3389

Trust: 0.1

url:https://www.apple.com/support/security/pgp/

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2012-1667

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2012-2386

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2012-0650

Trust: 0.1

url:http://gpgtools.org

Trust: 0.1

url:http://httpd.apache.org/.

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2011-3026

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2012-0643

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2012-3716

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/php5/5.3.5-1ubuntu7.8

Trust: 0.1

url:http://people.canonical.com/~ubuntu-security/cve/2012/cve-2012-2311.html

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/php5/5.3.10-1ubuntu3.1

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/php5/5.2.4-2ubuntu5.24

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/php5/5.3.2-1ubuntu4.15

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/php5/5.3.6-13ubuntu3.7

Trust: 0.1

url:http://www.ubuntu.com/usn/usn-1437-1

Trust: 0.1

sources: VULMON: CVE-2012-1823 // BID: 53388 // PACKETSTORM: 112465 // PACKETSTORM: 112631 // PACKETSTORM: 121573 // PACKETSTORM: 114272 // PACKETSTORM: 112580 // PACKETSTORM: 113905 // PACKETSTORM: 112606 // PACKETSTORM: 112612 // PACKETSTORM: 112508 // PACKETSTORM: 116792 // PACKETSTORM: 112474 // CNNVD: CNNVD-201205-108 // NVD: CVE-2012-1823

CREDITS

De Eindbazen

Trust: 0.3

sources: BID: 53388

SOURCES

db:VULMONid:CVE-2012-1823
db:BIDid:53388
db:PACKETSTORMid:112465
db:PACKETSTORMid:112631
db:PACKETSTORMid:121573
db:PACKETSTORMid:114272
db:PACKETSTORMid:112580
db:PACKETSTORMid:113905
db:PACKETSTORMid:112606
db:PACKETSTORMid:112612
db:PACKETSTORMid:112508
db:PACKETSTORMid:116792
db:PACKETSTORMid:112474
db:CNNVDid:CNNVD-201205-108
db:NVDid:CVE-2012-1823

LAST UPDATE DATE

2024-11-12T22:00:19.170000+00:00


SOURCES UPDATE DATE

db:VULMONid:CVE-2012-1823date:2018-01-18T00:00:00
db:BIDid:53388date:2015-04-13T22:15:00
db:CNNVDid:CNNVD-201205-108date:2012-05-08T00:00:00
db:NVDid:CVE-2012-1823date:2024-07-16T17:48:42.937

SOURCES RELEASE DATE

db:VULMONid:CVE-2012-1823date:2012-05-11T00:00:00
db:BIDid:53388date:2012-05-04T00:00:00
db:PACKETSTORMid:112465date:2012-05-05T05:25:23
db:PACKETSTORMid:112631date:2012-05-11T21:47:37
db:PACKETSTORMid:121573date:2013-05-09T14:44:00
db:PACKETSTORMid:114272date:2012-06-28T03:39:12
db:PACKETSTORMid:112580date:2012-05-10T03:59:25
db:PACKETSTORMid:113905date:2012-06-19T18:22:00
db:PACKETSTORMid:112606date:2012-05-10T21:02:26
db:PACKETSTORMid:112612date:2012-05-10T06:23:20
db:PACKETSTORMid:112508date:2012-05-07T20:04:50
db:PACKETSTORMid:116792date:2012-09-22T06:30:43
db:PACKETSTORMid:112474date:2012-05-06T01:28:45
db:CNNVDid:CNNVD-201205-108date:2012-05-08T00:00:00
db:NVDid:CVE-2012-1823date:2012-05-11T10:15:48.043