CVE-2010-2191: Buffer Overflow

Published Jun 7, 2010

Updated

The (1) parsestr, (2) pregmatch, (3) unpack, and (4) pack functions; the (5) ZENDFETCHRW, (6) ZENDCONCAT, and (7) ZENDASSIGNCONCAT opcodes; and the (8) ArrayObject::uasort method in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) or trigger memory corruption by causing a userspace interruption of an internal function or handler. NOTE: vectors 2 through 4 are related to the call time pass by reference feature.

Affected Software

17 affected components

PHP PHP=5.2.0

PHP PHP=5.2.1

PHP PHP=5.2.2

PHP PHP=5.2.3

PHP PHP=5.2.4

PHP PHP=5.2.5

PHP PHP=5.2.6

PHP PHP=5.2.7

PHP PHP=5.2.8

PHP PHP=5.2.9

PHP PHP=5.2.10

PHP PHP=5.2.11

PHP PHP=5.2.12

PHP PHP=5.2.13

PHP PHP=5.3.0

PHP PHP=5.3.1

PHP PHP=5.3.2

Event History

Jun 7, 2010

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Jun 8, 2010

Data Sourced

via NVD·12:30 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2010-2191?

CVE-2010-2191 is considered a moderate severity vulnerability that could allow context-dependent attackers to obtain sensitive information from affected PHP versions.

How do I fix CVE-2010-2191?

To fix CVE-2010-2191, upgrade your PHP installation to version 5.3.3 or later, which addresses this vulnerability.

Which versions of PHP are affected by CVE-2010-2191?

CVE-2010-2191 affects PHP versions 5.2.0 through 5.2.13 and 5.3.0 through 5.3.2.

What components of PHP are vulnerable in CVE-2010-2191?

The CVE-2010-2191 vulnerability affects the parse_str, preg_match, unpack, pack functions, several opcodes, and the ArrayObject::uasort method.

Can CVE-2010-2191 be exploited remotely?

Yes, CVE-2010-2191 can be exploited remotely if attackers can leverage context-specific conditions to gain access to sensitive information.