CVE-2010-1915: Infoleak

Published May 12, 2010

Updated

The pregquote function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature, modification of ZVALs whose values are not updated in the associated local variables, and access of previously-freed memory.

Affected Software

16 affected components

PHP PHP=5.2.9

PHP PHP=5.3.1

PHP PHP=5.2.7

PHP PHP=5.2.2

PHP PHP=5.2.5

PHP PHP=5.2.12

PHP PHP=5.2.11

PHP PHP=5.2.6

PHP PHP=5.3.0

PHP PHP=5.2.3

PHP PHP=5.2.0

PHP PHP=5.2.4

PHP PHP=5.3.2

PHP PHP=5.2.10

PHP PHP=5.2.1

PHP PHP=5.2.8

Event History

May 12, 2010

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·11:46 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2010-1915?

CVE-2010-1915 is classified as a vulnerability that can lead to information disclosure.

How do I fix CVE-2010-1915?

To fix CVE-2010-1915, upgrade to PHP version 5.3.3 or later, or 5.2.14 or later.

What versions of PHP are affected by CVE-2010-1915?

CVE-2010-1915 affects PHP versions 5.2.0 through 5.2.13 and 5.3.0 through 5.3.2.

What kind of information can be exposed due to CVE-2010-1915?

CVE-2010-1915 can potentially expose sensitive memory contents to context-dependent attackers.

Is there a workaround for CVE-2010-1915 until I can update PHP?

There are no known effective workarounds for CVE-2010-1915, so updating PHP is recommended.