CVE-2011-1470: Input Validation
Published Mar 20, 2011
·Updated
The Zip extension in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (application crash) via a ziparchive stream that is not properly handled by the streamgetcontents function.
Affected Software
110 affected components
PHP PHP<=5.3.5
PHP PHP=1.0
PHP PHP=2.0
PHP PHP=2.0b10
PHP PHP=3.0
PHP PHP=3.0.1
PHP PHP=3.0.2
PHP PHP=3.0.3
PHP PHP=3.0.4
PHP PHP=3.0.5
PHP PHP=3.0.6
PHP PHP=3.0.7
PHP PHP=3.0.8
PHP PHP=3.0.9
PHP PHP=3.0.10
PHP PHP=3.0.11
PHP PHP=3.0.12
PHP PHP=3.0.13
PHP PHP=3.0.14
PHP PHP=3.0.15
PHP PHP=3.0.16
PHP PHP=3.0.17
PHP PHP=3.0.18
PHP PHP=4.0
PHP PHP=4.0-beta_4_patch1
PHP PHP=4.0-beta1
PHP PHP=4.0-beta2
PHP PHP=4.0-beta3
PHP PHP=4.0-beta4
PHP PHP=4.0.0
PHP PHP=4.0.1
PHP PHP=4.0.2
PHP PHP=4.0.3
PHP PHP=4.0.4
PHP PHP=4.0.5
PHP PHP=4.0.6
PHP PHP=4.0.7
PHP PHP=4.1.0
PHP PHP=4.1.1
PHP PHP=4.1.2
PHP PHP=4.2.0
PHP PHP=4.2.1
PHP PHP=4.2.2
PHP PHP=4.2.3
PHP PHP=4.3.0
PHP PHP=4.3.1
PHP PHP=4.3.2
PHP PHP=4.3.3
PHP PHP=4.3.4
PHP PHP=4.3.5
PHP PHP=4.3.6
PHP PHP=4.3.7
PHP PHP=4.3.8
PHP PHP=4.3.9
PHP PHP=4.3.10
PHP PHP=4.3.11
PHP PHP=4.4.0
PHP PHP=4.4.1
PHP PHP=4.4.2
PHP PHP=4.4.3
PHP PHP=4.4.4
PHP PHP=4.4.5
PHP PHP=4.4.6
PHP PHP=4.4.7
PHP PHP=4.4.8
PHP PHP=4.4.9
PHP PHP=5.0.0
PHP PHP=5.0.0-beta1
PHP PHP=5.0.0-beta2
PHP PHP=5.0.0-beta3
PHP PHP=5.0.0-beta4
PHP PHP=5.0.0-rc1
PHP PHP=5.0.0-rc2
PHP PHP=5.0.0-rc3
PHP PHP=5.0.1
PHP PHP=5.0.2
PHP PHP=5.0.3
PHP PHP=5.0.4
PHP PHP=5.0.5
PHP PHP=5.1.0
PHP PHP=5.1.1
PHP PHP=5.1.2
PHP PHP=5.1.3
PHP PHP=5.1.4
PHP PHP=5.1.5
PHP PHP=5.1.6
PHP PHP=5.2.0
PHP PHP=5.2.1
PHP PHP=5.2.2
PHP PHP=5.2.3
PHP PHP=5.2.4
PHP PHP=5.2.4
PHP PHP=5.2.5
PHP PHP=5.2.6
PHP PHP=5.2.7
PHP PHP=5.2.8
PHP PHP=5.2.9
PHP PHP=5.2.10
PHP PHP=5.2.11
PHP PHP=5.2.12
PHP PHP=5.2.13
PHP PHP=5.2.14
PHP PHP=5.2.15
PHP PHP=5.2.16
PHP PHP=5.2.17
PHP PHP=5.3.0
PHP PHP=5.3.1
PHP PHP=5.3.2
PHP PHP=5.3.3
PHP PHP=5.3.4
Event History
Mar 20, 2011
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2011-1470?
CVE-2011-1470 has a moderate severity rating as it can cause application crashes due to denial of service.
2
How do I fix CVE-2011-1470?
To address CVE-2011-1470, upgrade to PHP version 5.3.6 or later, where the vulnerability is patched.
3
What versions of PHP are affected by CVE-2011-1470?
CVE-2011-1470 affects all PHP versions prior to 5.3.6 and specific versions like 1.0 to 4.x.
4
What impact does CVE-2011-1470 have on applications?
CVE-2011-1470 can lead to denial of service, causing applications that utilize the Zip extension to crash.
5
Is there a workaround for CVE-2011-1470 if I can't upgrade PHP?
As a temporary workaround for CVE-2011-1470, avoid using the Zip extension in PHP until an upgrade can be performed.