CVE-2011-1148: Use After Free

Q: What is the severity of CVE-2011-1148?

CVE-2011-1148 is categorized as a denial of service vulnerability due to memory corruption, with the potential for undefined impact.

Q: How do I fix CVE-2011-1148?

To mitigate CVE-2011-1148, users should upgrade to PHP version 5.3.7 or later, or apply the appropriate patches if available.

Q: Which versions of PHP are affected by CVE-2011-1148?

CVE-2011-1148 affects PHP versions 5.3.6 and earlier, as well as multiple older versions such as 4.x and 3.x.

Q: Can CVE-2011-1148 lead to remote code execution?

While CVE-2011-1148 primarily causes denial of service, it may also allow attackers to exploit memory corruption to achieve further impacts depending on the context.

Q: Are there any known exploits for CVE-2011-1148?

There are no publicly disclosed exploits for CVE-2011-1148, but the vulnerability allows for potential memory manipulation that could be exploited.

Published Mar 18, 2011

Updated

Use-after-free vulnerability in the substrreplace function in PHP 5.3.6 and earlier allows context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact by using the same variable for multiple arguments.

Affected Software

72 affected components

PHP PHP=4.3.9

PHP PHP=4.4.9

PHP PHP=3.0

PHP PHP=4.0-beta1

PHP PHP=3.0.5

PHP PHP=3.0.11

PHP PHP=4.0-beta4

PHP PHP=5.3.1

PHP PHP=4.2.0

PHP PHP=3.0.1

PHP PHP=3.0.2

PHP PHP=4.4.4

PHP PHP=4.1.0

PHP PHP=4.3.4

PHP PHP=4.0.4

PHP PHP=4.3.0

PHP PHP=4.0.5

PHP PHP=3.0.8

PHP PHP=4.3.6

PHP PHP=3.0.13

PHP PHP=4.3.7

PHP PHP=4.2.2

PHP PHP=4.4.2

PHP PHP=3.0.7

PHP PHP=4.3.2

PHP PHP=4.3.11

PHP PHP=4.0.0

PHP PHP=3.0.6

PHP PHP=3.0.17

PHP PHP=4.0.7

PHP PHP=4.0.2

PHP PHP=4.3.3

PHP PHP=2.0

PHP PHP=4.1.1

PHP PHP=3.0.15

PHP PHP=3.0.16

PHP PHP=5.3.0

PHP PHP=4.4.3

PHP PHP=5.3.3

PHP PHP=3.0.10

PHP PHP=3.0.4

PHP PHP=4.2.3

PHP PHP=4.4.5

PHP PHP=4.0

PHP PHP=4.0-beta2

PHP PHP=2.0b10

PHP PHP=4.4.8

PHP PHP=4.0.6

PHP PHP=4.1.2

PHP PHP=5.3.2

PHP PHP=5.3.4

PHP PHP=4.3.1

PHP PHP=3.0.18

PHP PHP=4.0-beta_4_patch1

PHP PHP=4.4.0

PHP PHP=4.3.10

PHP PHP=4.2.1

PHP PHP=4.0.1

PHP PHP=1.0

PHP PHP=4.4.6

PHP PHP=3.0.12

PHP PHP=5.3.5

PHP PHP<=5.3.6

PHP PHP=4.4.1

PHP PHP=4.0-beta3

PHP PHP=4.0.3

PHP PHP=3.0.14

PHP PHP=3.0.9

PHP PHP=3.0.3

PHP PHP=4.3.8

PHP PHP=4.3.5

PHP PHP=4.4.7

Event History

Mar 18, 2011

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2011-1148?

CVE-2011-1148 is categorized as a denial of service vulnerability due to memory corruption, with the potential for undefined impact.

How do I fix CVE-2011-1148?

To mitigate CVE-2011-1148, users should upgrade to PHP version 5.3.7 or later, or apply the appropriate patches if available.

Which versions of PHP are affected by CVE-2011-1148?