CVE-2010-2531: Infoleak
The upstream PHP 5.2.14 and 5.3.3 releases corrected an information disclosure flaw where the varexport() function would disclose data if a fatal error occurred due to recursion, memorylimit, or execution time. The buffer is never cleared and is flushed to the user, regardless of the configured displayerrors setting, because it is considered part of the output. This could lead to a disclosure of possibly sensitive information.
The name CVE-2010-2531 has been assigned to this issue.
An example to test:
% cat test.php #!/usr/bin/php <?php @$obj->p =& $obj; varexport($obj, true); ?> % php test.php PHP Fatal error: Nesting level too deep - recursive dependency? in test.php on line 4 stdClass::setstate(array( 'p' => stdClass::setstate(array( 'p' => stdClass::setstate(array( 'p' => stdClass::setstate(array( % cat test2.php #!/usr/bin/php <?php $a[] =& $a; varexport($a, true); ?> % php test2.php PHP Fatal error: Nesting level too deep - recursive dependency? in test.php on line 4 array ( 0 => array ( 0 => array ( 0 => array ( 0 => array (
The upstream changes prevent any output from displaying, so should only display the "PHP Fatal error".
The upstream fix:
http://svn.php.net/viewvc?view=revision&revision=301143
Other sources
The varexport function in PHP 5.2 before 5.2.14 and 5.3 before 5.3.3 flushes the output buffer to the user when certain fatal errors occur, even if displayerrors is off, which allows remote attackers to obtain sensitive information by causing the application to exceed limits for memory, execution time, or recursion.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2531?
CVE-2010-2531 has been classified as a moderate security vulnerability.
How do I fix CVE-2010-2531?
To fix CVE-2010-2531, upgrade to PHP versions 5.2.14 or 5.3.3 or later.
What types of systems are affected by CVE-2010-2531?
CVE-2010-2531 affects systems running PHP versions up to 5.2.14 and 5.3.3, particularly on Red Hat and Debian distributions.
What does CVE-2010-2531 mean for my PHP applications?
CVE-2010-2531 could lead to sensitive data exposure in PHP applications during fatal errors due to recursive calls or resource limits.
Is CVE-2010-2531 a zero-day vulnerability?
No, CVE-2010-2531 is not a zero-day vulnerability as it was publicly disclosed and patched in 2010.