CVE-2012-0788: Input Validation

First published: Sat Jan 21 2012(Updated: )

<a href="https://bugs.php.net/bug.php?id=55776">https://bugs.php.net/bug.php?id=55776</a> [2011-09-24 19:21 UTC] grinyad at mail dot ru Description: ------------ <?php // make a Pdo_Mysql statement before $result = $stmt->fetch(PDO::FETCH_LAZY); session_start(); $_SESSION['PDORow'] = $result; ?> Is crashing on next request after saving PDORow to session on session_start() [2011-09-24 19:24 UTC] aharvey What do you mean by "crashing"? Is the actual PHP process crashing, or are you just getting an error message because PDO statements aren't serialisable (which is expected)? [2011-09-25 08:56 UTC] grinyad at mail dot ru Is a Apache crash. It gives a CGI/FastCGI Send/Don't Send window. <a href="http://img171.imageshack.us/img171/3953/57126366.jpg">http://img171.imageshack.us/img171/3953/57126366.jpg</a> After few minutes is crashing apache server: <a href="http://img840.imageshack.us/img840/2981/21231006.jpg">http://img840.imageshack.us/img840/2981/21231006.jpg</a> [2011-09-25 12:39 UTC] johannes PDORow objects may not be serialized and therefore not be put in a session. In svn it was fixed to throw a warning and not crash anymore this will be in future releases.

Credit: secalert@redhat.com

Affected Software	Affected Version	How to fix
redhat/php	<5.3.9	5.3.9
PHP PHP	<=5.3.8
PHP PHP	=5.0.0
PHP PHP	=5.0.0-beta1
PHP PHP	=5.0.0-beta2
PHP PHP	=5.0.0-beta3
PHP PHP	=5.0.0-beta4
PHP PHP	=5.0.0-rc1
PHP PHP	=5.0.0-rc2
PHP PHP	=5.0.0-rc3
PHP PHP	=5.0.1
PHP PHP	=5.0.2
PHP PHP	=5.0.3
PHP PHP	=5.0.4
PHP PHP	=5.0.5
PHP PHP	=5.1.1
PHP PHP	=5.1.2
PHP PHP	=5.1.3
PHP PHP	=5.1.4
PHP PHP	=5.1.5
PHP PHP	=5.1.6
PHP PHP	=5.2.0
PHP PHP	=5.2.1
PHP PHP	=5.2.2
PHP PHP	=5.2.3
PHP PHP	=5.2.4
PHP PHP	=5.2.5
PHP PHP	=5.2.6
PHP PHP	=5.2.7
PHP PHP	=5.2.8
PHP PHP	=5.2.9
PHP PHP	=5.2.10
PHP PHP	=5.2.11
PHP PHP	=5.2.12
PHP PHP	=5.2.14
PHP PHP	=5.2.15
PHP PHP	=5.2.16
PHP PHP	=5.2.17
PHP PHP	=5.3.0
PHP PHP	=5.3.1
PHP PHP	=5.3.2
PHP PHP	=5.3.3
PHP PHP	=5.3.4
PHP PHP	=5.3.5
PHP PHP	=5.3.6
PHP PHP	=5.3.7

CVE-2012-0788: Input Validation

Never miss a vulnerability like this again

Reference Links

Company

Resources

Contact