CVE-2011-2772: Input Validation
Published Nov 15, 2011
·Updated
The getdatarootimagepath function in lib/file.php in Mahara before 1.4.1 does not properly validate uploaded image files, which allows remote attackers to cause a denial of service (memory consumption) via a (1) large or (2) invalid image.
Affected Software
72 affected components
Mahara Mahara=1.1.0-beta4
Mahara Mahara=1.1.6
Mahara Mahara=1.2.0
Mahara Mahara=0.9.1
Mahara Mahara=1.1.2
Mahara Mahara=1.2.3
Mahara Mahara=1.0.4
Mahara Mahara=1.1.7
Mahara Mahara=1.2.1
Mahara Mahara=1.3.2
Mahara Mahara=0.9.2
Mahara Mahara=1.4-rc2
Mahara Mahara=1.0.1
Mahara Mahara=1.0.8
Mahara Mahara=1.2.0-rc1
Mahara Mahara=1.2.0-alpha1
Mahara Mahara=1.0.12
Mahara Mahara=1.0.15
Mahara Mahara=1.0.6
Mahara Mahara=1.3.0-beta1
Mahara Mahara=1.0.9
Mahara Mahara=1.2.0-alpha2
Mahara Mahara=1.3.0-rc1
Mahara Mahara=1.1.9
Mahara Mahara=1.0.5
Mahara Mahara=1.1
Mahara Mahara=1.2.0-beta4
Mahara Mahara=1.3.7
Mahara Mahara=1.4-rc4
Mahara Mahara=1.1.0-alpha3
Mahara Mahara=1.1.4
Mahara Mahara=1.2.0-alpha3
Mahara Mahara=1.2.0-beta2
Mahara Mahara=1.2.6
Mahara Mahara=1.3.0
Mahara Mahara=1.0.2
Mahara Mahara=1.1.0-beta1
Mahara Mahara=1.0.3
Mahara Mahara=1.4-rc3
Mahara Mahara=1.3.6
Mahara Mahara=1.0.13
Mahara Mahara=1.3.1
Mahara Mahara=1.0.10
Mahara Mahara=1.1.0-rc2
Mahara Mahara=1.1.1
Mahara Mahara=1.3.0-beta2
Mahara Mahara=1.1.8
Mahara Mahara=1.1.0-beta3
Mahara Mahara=1.2.4
Mahara Mahara=1.1.0-alpha1
Mahara Mahara=1.3.5
Mahara Mahara=1.3.0-beta3
Mahara Mahara<=1.4.0
Mahara Mahara=1.1.0-alpha2
Mahara Mahara=1.4-rc1
Mahara Mahara=1.2.2
Mahara Mahara=1.2.5
Mahara Mahara=1.1.3
Mahara Mahara=1.3.4
Mahara Mahara=1.0.7
Mahara Mahara=1.0.0
Mahara Mahara=1.1.0
Mahara Mahara=1.1.5
Mahara Mahara=1.2.0-beta1
Mahara Mahara=1.1.0-beta2
Mahara Mahara=1.1.0-rc1
Mahara Mahara=1.2.0-beta3
Mahara Mahara=1.3.3
Mahara Mahara=1.0.14
Mahara Mahara=1.3.0-beta4
Mahara Mahara=1.0.11
Mahara Mahara=0.9.0
Remediation
Patch Available
Event History
Nov 15, 2011
CVE Published
via MITRE·02:00 AM
Data Sourced
via MITRE·02:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2011-2772?
CVE-2011-2772 has a severity that can lead to denial of service due to memory consumption.
2
How do I fix CVE-2011-2772?
To fix CVE-2011-2772, you should upgrade to Mahara version 1.4.1 or later.
3
Which versions of Mahara are affected by CVE-2011-2772?
CVE-2011-2772 affects Mahara versions prior to 1.4.1, including all versions from 0.9.0 to 1.3.7.
4
What is the impact of exploiting CVE-2011-2772?
Exploiting CVE-2011-2772 can lead to denial of service by consuming excessive memory resources.
5
Is there a patch available for CVE-2011-2772?
Yes, a patch is included in the upgrade to Mahara version 1.4.1, which mitigates this vulnerability.