5 - CVE-2012-0781

Executive Summary

Informations
Name	CVE-2012-0781	First vendor Publication	2012-01-18
Vendor	Cve	Last vendor Modification	2024-11-21

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Cvss Base Score	5	Attack Range	Network
Cvss Impact Score	2.9	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

The tidy_diagnose function in PHP 5.3.8 might allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted input to an application that attempts to perform Tidy::diagnose operations on invalid objects, a different vulnerability than CVE-2011-4153.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0781

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-399	Resource Management Errors

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:27681

Oval ID:	oval:org.mitre.oval:def:27681
Title:	DEPRECATED: ELSA-2012-1046 -- php security update (moderate)
Description:	[5.3.3-14] - add security fix for CVE-2010-2950 [5.3.3-13] - fix tests for CVE-2012-2143, CVE-2012-0789 [5.3.3-12] - add fix for CVE-2012-2336 [5.3.3-11] - add security fixes for CVE-2012-0781, CVE-2011-4153, CVE-2012-0057, CVE-2012-0789, CVE-2012-1172, CVE-2012-2143, CVE-2012-2386 [5.3.3-9] - correct detection of = in CVE-2012-1823 fix (#818607) [5.3.3-8] - add security fix for CVE-2012-1823 (#818607) [5.3.3-7] - add security fix for CVE-2012-0830 (#786744) [5.3.3-6] - merge Joe's changes: - improve CVE-2011-1466 fix to cover CAL_GREGORIAN, CAL_JEWISH - add security fixes for CVE-2011-2483, CVE-2011-0708, CVE-2011-1148, CVE-2011-1466, CVE-2011-1468, CVE-2011-1469, CVE-2011-1470, CVE-2011-1471, CVE-2011-1938, and CVE-2011-2202 (#740732) [5.3.3-5] - remove extra php.ini-prod/devel files caused by %patch -b [5.3.3-4] - add security fixes for CVE-2011-4885, CVE-2011-4566 (#769755)
Family:	unix	Class:	patch
Reference(s):	ELSA-2012-1046 CVE-2012-2143 CVE-2011-4153 CVE-2012-0057 CVE-2012-0789 CVE-2012-1172 CVE-2012-2336 CVE-2010-2950 CVE-2012-2386 CVE-2012-0781	Version:	4
Platform(s):	Oracle Linux 6	Product(s):	php
Definition Synopsis:
Oracle Linux 6.x Packages match section php is earlier than 0:5.3.3-14.el6_3 AND php-bcmath is earlier than 0:5.3.3-14.el6_3 AND php-cli is earlier than 0:5.3.3-14.el6_3 AND php-common is earlier than 0:5.3.3-14.el6_3 AND php-dba is earlier than 0:5.3.3-14.el6_3 AND php-devel is earlier than 0:5.3.3-14.el6_3 AND php-embedded is earlier than 0:5.3.3-14.el6_3 AND php-enchant is earlier than 0:5.3.3-14.el6_3 AND php-gd is earlier than 0:5.3.3-14.el6_3 AND php-imap is earlier than 0:5.3.3-14.el6_3 AND php-intl is earlier than 0:5.3.3-14.el6_3 AND php-ldap is earlier than 0:5.3.3-14.el6_3 AND php-mbstring is earlier than 0:5.3.3-14.el6_3 AND php-mysql is earlier than 0:5.3.3-14.el6_3 AND php-odbc is earlier than 0:5.3.3-14.el6_3 AND php-pdo is earlier than 0:5.3.3-14.el6_3 AND php-pgsql is earlier than 0:5.3.3-14.el6_3 AND php-process is earlier than 0:5.3.3-14.el6_3 AND php-pspell is earlier than 0:5.3.3-14.el6_3 AND php-recode is earlier than 0:5.3.3-14.el6_3 AND php-snmp is earlier than 0:5.3.3-14.el6_3 AND php-soap is earlier than 0:5.3.3-14.el6_3 AND php-tidy is earlier than 0:5.3.3-14.el6_3 AND php-xml is earlier than 0:5.3.3-14.el6_3 AND php-xmlrpc is earlier than 0:5.3.3-14.el6_3 AND php-zts is earlier than 0:5.3.3-14.el6_3

CPE : Common Platform Enumeration

Type	Description	Count
Application	Php cpe:2.3:a:php:php:5.3.8:::::::*	1

OpenVAS Exploits

Date	Description
2012-12-13	Name : SuSE Update for update openSUSE-SU-2012:0426-1 (update) File : nvt/gb_suse_2012_0426_1.nasl
2012-07-30	Name : CentOS Update for php CESA-2012:1046 centos6 File : nvt/gb_CESA-2012_1046_php_centos6.nasl
2012-06-28	Name : RedHat Update for php RHSA-2012:1046-01 File : nvt/gb_RHSA-2012_1046-01_php.nasl
2012-06-22	Name : Ubuntu Update for php5 USN-1481-1 File : nvt/gb_ubuntu_USN_1481_1.nasl
2012-06-14	Name : PHP versoin < 5.3.9 File : nvt/nopsec_php_5_3_9.nasl
2012-03-12	Name : Debian Security Advisory DSA 2408-1 (php5) File : nvt/deb_2408_1.nasl
2012-01-23	Name : PHP Multiple Denial of Service Vulnerabilities (Windows) File : nvt/gb_php_mult_dos_vuln_win.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
78571	PHP tidy_diagnose Function Tidy::diagnose Operation Remote doS

Nessus® Vulnerability Scanner

Date	Description
2014-06-13	Name : The remote openSUSE host is missing a security update. File : openSUSE-2012-182.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2012-1046.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20120627_php_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2012-07-11	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2012-1046.nasl - Type : ACT_GATHER_INFO
2012-06-28	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2012-1046.nasl - Type : ACT_GATHER_INFO
2012-06-20	Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-1481-1.nasl - Type : ACT_GATHER_INFO
2012-04-13	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_apache2-mod_php5-120309.nasl - Type : ACT_GATHER_INFO
2012-03-26	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_apache2-mod_php5-8009.nasl - Type : ACT_GATHER_INFO
2012-02-14	Name : The remote Debian host is missing a security-related update. File : debian_DSA-2408.nasl - Type : ACT_GATHER_INFO
2012-01-13	Name : The remote web server uses a version of PHP that is affected by multiple flaws. File : php_5_3_9.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

http://archives.neohapsis.com/archives/bugtraq/2012-01/0092.html
http://cxsecurity.com/research/103
http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00013.html
http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00016.html
http://secunia.com/advisories/48668
http://www.exploit-db.com/exploits/18370/

Source	Url

Alert History

If you want to see full details history, please login or register.

Date	Informations
2024-11-28 23:03:06	Multiple Updates
2024-11-28 12:28:55	Multiple Updates
2021-05-04 12:19:18	Multiple Updates
2021-04-22 01:23:01	Multiple Updates
2020-05-23 00:32:58	Multiple Updates
2018-01-09 13:22:56	Multiple Updates
2016-04-26 21:33:06	Multiple Updates
2014-06-14 13:32:22	Multiple Updates
2014-02-17 11:08:17	Multiple Updates
2013-05-10 22:33:48	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	1
Oval ID(s)	1
CPE ID(s)	1
Sources(s)	6
osvdb(s)	1
Openvas Exploit(s)	7
Nessus® Exploit(s)	10

	Related
7.5	USN-1481-1
7.5	RHSA-2012:1046
7.5	DSA-2408
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 3 more Alert(s)

5 - CVE-2012-0781

Executive Summary

Security-Database Scoring CVSS v3

Security-Database Scoring CVSS v2

Detail

Original Source

CWE : Common Weakness Enumeration

OVAL Definitions

CPE : Common Platform Enumeration

OpenVAS Exploits

Open Source Vulnerability Database (OSVDB)

Nessus® Vulnerability Scanner

Sources (Detail)

Alert History

Global Informations

Open Standards

Other Databases

COMPANY

STANDARDS

RECENT POSTS

MENU