CVE-2010-1914: Infoleak

Published May 12, 2010

Updated

The Zend Engine in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information by interrupting the handler for the (1) ZENDBWXOR opcode (shiftleftfunction), (2) ZENDSL opcode (bitwisexorfunction), or (3) ZENDSR opcode (shiftrightfunction), related to the converttolongbase function.

Affected Software

16 affected components

PHP PHP=5.2.9

PHP PHP=5.3.1

PHP PHP=5.2.7

PHP PHP=5.2.2

PHP PHP=5.2.5

PHP PHP=5.2.12

PHP PHP=5.2.11

PHP PHP=5.2.6

PHP PHP=5.3.0

PHP PHP=5.2.3

PHP PHP=5.2.0

PHP PHP=5.2.4

PHP PHP=5.3.2

PHP PHP=5.2.10

PHP PHP=5.2.1

PHP PHP=5.2.8

Event History

May 12, 2010

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·11:46 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2010-1914?

CVE-2010-1914 is classified as a medium severity vulnerability due to the potential for sensitive information disclosure.

How do I fix CVE-2010-1914?

To fix CVE-2010-1914, upgrade PHP to version 5.3.3 or higher, or apply the appropriate patches if available.

What versions of PHP are affected by CVE-2010-1914?

CVE-2010-1914 affects PHP versions 5.2.0 through 5.2.13 and 5.3.0 through 5.3.2.

What type of attack does CVE-2010-1914 facilitate?

CVE-2010-1914 allows context-dependent attackers to obtain sensitive information through opcode interruption.

Is CVE-2010-1914 an exploit that requires authentication?

CVE-2010-1914 may be exploited by attackers who have access to the PHP environment, potentially requiring no authentication to exploit.