medium
5
CWE
200
Advisory Published
CVE Published
Updated

CVE-2013-1643: Infoleak

First published: Tue Mar 05 2013(Updated: )

A security flaw was found in the way SOAP parser of PHP processed certain SOAP objects (due to allowed expansion of XML external entities during SOAP WSDL files parsing, it was previously possible to read arbitrary system files, accessible with the privileges of the PHP application). If a PHP application accepted untrusted SOAP object input remotely from clients, an attacker could use this flaw for unauthorized of read system files (accesible with the privileges of the PHP application). References: [1] <a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702221">http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702221</a> [2] <a href="https://bugs.gentoo.org/show_bug.cgi?id=459904">https://bugs.gentoo.org/show_bug.cgi?id=459904</a> [3] <a href="http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2013:016/">http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2013:016/</a> Relevant upstream patch: [4] <a href="http://git.php.net/?p=php-src.git;a=commitdiff;h=c737b89473df9dba6742b8fc8fbf6d009bf05c36">http://git.php.net/?p=php-src.git;a=commitdiff;h=c737b89473df9dba6742b8fc8fbf6d009bf05c36</a>

Credit: cve@mitre.org

Affected SoftwareAffected VersionHow to fix
redhat/php<5.3.23
5.3.23
redhat/php<5.4.13
5.4.13
PHP<=5.3.21
PHP=1.0
PHP=2.0
PHP=2.0b10
PHP=3.0
PHP=3.0.1
PHP=3.0.2
PHP=3.0.3
PHP=3.0.4
PHP=3.0.5
PHP=3.0.6
PHP=3.0.7
PHP=3.0.8
PHP=3.0.9
PHP=3.0.10
PHP=3.0.11
PHP=3.0.12
PHP=3.0.13
PHP=3.0.14
PHP=3.0.15
PHP=3.0.16
PHP=3.0.17
PHP=3.0.18
PHP=4.0-beta_4_patch1
PHP=4.0-beta1
PHP=4.0-beta2
PHP=4.0-beta3
PHP=4.0-beta4
PHP=4.0.0
PHP=4.0.1
PHP=4.0.2
PHP=4.0.3
PHP=4.0.4
PHP=4.0.5
PHP=4.0.6
PHP=4.0.7
PHP=4.1.0
PHP=4.1.1
PHP=4.1.2
PHP=4.2.0
PHP=4.2.1
PHP=4.2.2
PHP=4.2.3
PHP=4.3.0
PHP=4.3.1
PHP=4.3.2
PHP=4.3.3
PHP=4.3.4
PHP=4.3.5
PHP=4.3.6
PHP=4.3.7
PHP=4.3.8
PHP=4.3.9
PHP=4.3.10
PHP=4.3.11
PHP=4.4.0
PHP=4.4.1
PHP=4.4.2
PHP=4.4.3
PHP=4.4.4
PHP=4.4.5
PHP=4.4.6
PHP=4.4.7
PHP=4.4.8
PHP=4.4.9
PHP=5.0.0
PHP=5.0.0-beta1
PHP=5.0.0-beta2
PHP=5.0.0-beta3
PHP=5.0.0-beta4
PHP=5.0.0-rc1
PHP=5.0.0-rc2
PHP=5.0.0-rc3
PHP=5.0.1
PHP=5.0.2
PHP=5.0.3
PHP=5.0.4
PHP=5.0.5
PHP=5.1.0
PHP=5.1.1
PHP=5.1.2
PHP=5.1.3
PHP=5.1.4
PHP=5.1.5
PHP=5.1.6
PHP=5.2.0
PHP=5.2.1
PHP=5.2.2
PHP=5.2.3
PHP=5.2.4
PHP=5.2.5
PHP=5.2.6
PHP=5.2.7
PHP=5.2.8
PHP=5.2.9
PHP=5.2.10
PHP=5.2.11
PHP=5.2.12
PHP=5.2.13
PHP=5.2.14
PHP=5.2.15
PHP=5.2.16
PHP=5.2.17
PHP=5.3.0
PHP=5.3.1
PHP=5.3.2
PHP=5.3.3
PHP=5.3.4
PHP=5.3.5
PHP=5.3.6
PHP=5.3.7
PHP=5.3.8
PHP=5.3.9
PHP=5.3.10
PHP=5.3.11
PHP=5.3.12
PHP=5.3.13
PHP=5.3.14
PHP=5.3.15
PHP=5.3.16
PHP=5.3.17
PHP=5.3.18
PHP=5.3.19
PHP=5.3.20
PHP=5.4.0
PHP=5.4.1
PHP=5.4.2
PHP=5.4.3
PHP=5.4.4
PHP=5.4.5
PHP=5.4.6
PHP=5.4.7
PHP=5.4.8
PHP=5.4.9
PHP=5.4.10
PHP=5.4.11
PHP=5.4.12

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2013-1643?

    The severity of CVE-2013-1643 is considered high due to its potential to allow unauthorized file access.

  • How do I fix CVE-2013-1643?

    To fix CVE-2013-1643, upgrade PHP to version 5.3.23 or 5.4.13 or later.

  • Which versions of PHP are affected by CVE-2013-1643?

    CVE-2013-1643 affects PHP versions up to and including 5.3.21 and 5.4.12.

  • What vulnerabilities can CVE-2013-1643 exploit?

    CVE-2013-1643 can exploit vulnerabilities in the SOAP parser to read arbitrary system files.

  • Is CVE-2013-1643 remote code execution vulnerability?

    CVE-2013-1643 is not a remote code execution vulnerability but allows file access on the server.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203