Vulnerability Description
The asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse (1) notBefore and (2) notAfter timestamps in X.509 certificates, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted certificate that is not properly handled by the openssl_x509_parse function.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Php | Php | 5.4.0 |
| Opensuse | Opensuse | 11.4 |
| Apple | Mac Os X | <= 10.9.1 |
Related Weaknesses (CWE)
References
- http://forums.interworx.com/threads/8000-InterWorx-Version-5-0-14-Released-on-Be
- http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=c1224573c773b6845e83505f717fbf8
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00125.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00126.html
- http://rhn.redhat.com/errata/RHSA-2013-1813.html
- http://rhn.redhat.com/errata/RHSA-2013-1815.html
- http://rhn.redhat.com/errata/RHSA-2013-1824.html
- http://rhn.redhat.com/errata/RHSA-2013-1825.html
- http://rhn.redhat.com/errata/RHSA-2013-1826.html
- http://secunia.com/advisories/59652
- http://support.apple.com/kb/HT6150
- http://www.debian.org/security/2013/dsa-2816
- http://www.php.net/ChangeLog-5.php
- http://www.securityfocus.com/bid/64225
- http://www.securitytracker.com/id/1029472
FAQ
What is CVE-2013-6420?
CVE-2013-6420 is a vulnerability with a CVSS score of 7.5 (HIGH). The asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse (1) notBefore and (2) notAfter timestamps in X.509 c...
How severe is CVE-2013-6420?
CVE-2013-6420 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2013-6420?
Check the references section above for vendor advisories and patch information. Affected products include: Php Php, Opensuse Opensuse, Apple Mac Os X.