CVE-2013-3735: Input Validation

Q: What is the severity of CVE-2013-3735?

CVE-2013-3735 has a severity rating that indicates the potential for a denial of service, particularly through application crash or memory exhaustion.

Q: How do I fix CVE-2013-3735?

To fix CVE-2013-3735, upgrade your PHP version to at least 5.4.16 RC1 or 5.5.0 RC2 to mitigate the vulnerability.

Q: What versions of PHP are affected by CVE-2013-3735?

CVE-2013-3735 affects PHP versions prior to 5.4.16 RC1 and 5.5.0 before RC2.

Q: What kind of attack does CVE-2013-3735 enable?

CVE-2013-3735 allows context-dependent attackers to exploit a parser error leading to denial of service conditions.

Q: Is there any workaround for CVE-2013-3735?

There are no known workarounds for CVE-2013-3735, and the recommended approach is to upgrade to a non-vulnerable PHP version.

Published May 31, 2013

Updated

DISPUTED The Zend Engine in PHP before 5.4.16 RC1, and 5.5.0 before RC2, does not properly determine whether a parser error occurred, which allows context-dependent attackers to cause a denial of service (memory consumption and application crash) via a crafted function definition, as demonstrated by an attack within a shared web-hosting environment. NOTE: the vendor's http://php.net/security-note.php page says "for critical security situations you should be using OS-level security by running multiple web servers each as their own user id."

Affected Software

31 affected components

PHP PHP<=5.4.15

PHP PHP=5.4.0

PHP PHP=5.4.1

PHP PHP=5.4.2

PHP PHP=5.4.3

PHP PHP=5.4.4

PHP PHP=5.4.5

PHP PHP=5.4.6

PHP PHP=5.4.7

PHP PHP=5.4.8

PHP PHP=5.4.9

PHP PHP=5.4.10

PHP PHP=5.4.11

PHP PHP=5.4.12

PHP PHP=5.4.12-rc1

PHP PHP=5.4.12-rc2

PHP PHP=5.4.13

PHP PHP=5.4.13-rc1

PHP PHP=5.4.14

PHP PHP=5.4.14-rc1

PHP PHP<=5.5.0

PHP PHP=5.5.0-alpha1

PHP PHP=5.5.0-alpha2

PHP PHP=5.5.0-alpha3

PHP PHP=5.5.0-alpha4

PHP PHP=5.5.0-alpha5

PHP PHP=5.5.0-alpha6

PHP PHP=5.5.0-beta1

PHP PHP=5.5.0-beta2

PHP PHP=5.5.0-beta3

PHP PHP=5.5.0-beta4

Remediation

Patch Available

https://github.com/php/php-src/commit/fb58e69a84f4fde603a630d2c9df2fa3be16d846

Event History

May 31, 2013

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Disputed

09:55 PM

Frequently Asked Questions

What is the severity of CVE-2013-3735?

CVE-2013-3735 has a severity rating that indicates the potential for a denial of service, particularly through application crash or memory exhaustion.

How do I fix CVE-2013-3735?