CVE-2012-0789: Medium severity php vulnerability

Q: What is the severity of CVE-2012-0789?

CVE-2012-0789 is classified as a moderate severity vulnerability.

Q: How do I fix CVE-2012-0789?

To fix CVE-2012-0789, upgrade your PHP version to 5.3.9 or later.

Q: Which PHP versions are affected by CVE-2012-0789?

CVE-2012-0789 affects PHP versions up to and including 5.3.8, along with various older versions.

Q: What type of vulnerability is CVE-2012-0789?

CVE-2012-0789 is a memory leak vulnerability associated with the strtotime function.

Q: Is there a patch available for CVE-2012-0789?

Yes, patches are included in PHP versions released after 5.3.9 to address CVE-2012-0789.

Published Jan 21, 2012

Updated

https://bugs.php.net/bug.php?id=53502

[2010-12-08 21:04 UTC] jsheridan at tenable dot com

Description: ------------ strtotime calls with a timezone embedded function correctly but continually use up memory. In a daemon program this becomes quickly fatal.

Test script: --------------- <?php while (true) { strtotime('Monday 00:00 Europe/Paris'); // Memory leak } ?>

<?php while (true) { datedefaulttimezoneset("Europe/Paris"); strtotime('Monday 00:00'); // No memory leak } ?>

Expected result: ---------------- Memory usage should remain stable.

Other sources

Memory leak in the timezone functionality in PHP before 5.3.9 allows remote attackers to cause a denial of service (memory consumption) by triggering many strtotime function calls, which are not properly handled by the phpdateparsetzfile cache.

— MITRE

Affected Software

46 affected componentsFixes available

redhat/php<5.3.9

5.3.9

PHP PHP<=5.3.8

PHP PHP=5.0.0

PHP PHP=5.0.0-beta1

PHP PHP=5.0.0-beta2

PHP PHP=5.0.0-beta3

PHP PHP=5.0.0-beta4

PHP PHP=5.0.0-rc1

PHP PHP=5.0.0-rc2

PHP PHP=5.0.0-rc3

PHP PHP=5.0.1

PHP PHP=5.0.2

PHP PHP=5.0.3

PHP PHP=5.0.4

PHP PHP=5.0.5

PHP PHP=5.1.1

PHP PHP=5.1.2

PHP PHP=5.1.3

PHP PHP=5.1.4

PHP PHP=5.1.5

PHP PHP=5.1.6

PHP PHP=5.2.0

PHP PHP=5.2.1

PHP PHP=5.2.2

PHP PHP=5.2.3

PHP PHP=5.2.4

PHP PHP=5.2.5

PHP PHP=5.2.6

PHP PHP=5.2.7

PHP PHP=5.2.8

PHP PHP=5.2.9

PHP PHP=5.2.10

PHP PHP=5.2.11

PHP PHP=5.2.12

PHP PHP=5.2.14

PHP PHP=5.2.15

PHP PHP=5.2.16

PHP PHP=5.2.17

PHP PHP=5.3.0

PHP PHP=5.3.1

PHP PHP=5.3.2

PHP PHP=5.3.3

PHP PHP=5.3.4

PHP PHP=5.3.5

PHP PHP=5.3.6

PHP PHP=5.3.7

Event History

Jan 21, 2012

Data Sourced

via Red Hat·12:46 AM

DescriptionSeverityAffected Software

Feb 14, 2012

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2012-0789?

CVE-2012-0789 is classified as a moderate severity vulnerability.

How do I fix CVE-2012-0789?