CVE-2013-4113: Medium severity PHP PHP vulnerability
An array index error, leading to invalid free flaw was found in the way XML extension of PHP, a scripting language for creating dynamic web sites, used to convert certain XML files into PHP language internal structures. Remote attacker could provide a specially-crafted XML file, that when opened in an PHP application would lead to that application crash or, potentially, arbitrary code execution with the privileges of the user running the application.
References: http://php.net/archive/2013.php#id2013-07-11-1 http://www.php.net/ChangeLog-5.php#5.3.27
Upstream bug report: https://bugs.php.net/bug.php?id=65236
Relevant patch: https://bugs.php.net/patch-display.php?bugid=65236&patch=bug65236.diff&revision=latest http://git.php.net/?p=php-src.git;a=commitdiff;h=7d163e8a0880ae8af2dd869071393e5dc07ef271
Other sources
ext/xml/xml.c in PHP before 5.3.27 does not properly consider parsing depth, which allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted document that is processed by the xmlparseintostruct function.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4113?
CVE-2013-4113 is classified as a medium severity vulnerability due to the potential for remote code execution via a specially-crafted XML file.
How do I fix CVE-2013-4113?
To remediate CVE-2013-4113, upgrade PHP to version 5.3.27 or 5.4.18 or later.
What systems are affected by CVE-2013-4113?
CVE-2013-4113 affects PHP versions prior to 5.3.27 and 5.4.18.
What type of vulnerability is CVE-2013-4113?
CVE-2013-4113 is categorized as an array index error leading to an invalid free flaw.
Can CVE-2013-4113 be exploited remotely?
Yes, CVE-2013-4113 can be exploited remotely by an attacker providing a malicious XML file.