Back to Database
Status published
Medium
CVE-2013-4113
ext/xml/xml.c in PHP before 5.3.27 does not properly consider parsing...
Vulnerability Description
ext/xml/xml.c in PHP before 5.3.27 does not properly consider parsing depth, which allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted document that is processed by the xml_parse_into_struct function.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2013-4113
Credits & Attribution
No credits recorded in the NVD database.
References
- http://secunia.com/advisories/54071
- http://rhn.redhat.com/errata/RHSA-2013-1061.html
- http://secunia.com/advisories/54165
- http://secunia.com/advisories/54104
- http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00007.html
- http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=7d163e8a0880ae8af2dd869071393e5dc07ef271
- http://www.debian.org/security/2013/dsa-2723
- http://secunia.com/advisories/54163
- https://bugs.php.net/bug.php?id=65236
- http://www.ubuntu.com/usn/USN-1905-1
- http://rhn.redhat.com/errata/RHSA-2013-1062.html
- http://support.apple.com/kb/HT6150
- http://php.net/ChangeLog-5.php
- http://rhn.redhat.com/errata/RHSA-2013-1050.html
- http://rhn.redhat.com/errata/RHSA-2013-1049.html
- http://rhn.redhat.com/errata/RHSA-2013-1063.html
- http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00034.html
- https://bugzilla.redhat.com/show_bug.cgi?id=983689
- http://php.net/archive/2013.php#id2013-07-11-1
More from php
View All →CVE-2022-27158
pearweb < 1.32 suffers from Deserialization of Untrusted Data....
Critical
9.8
CVE-2022-27157
pearweb < 1.32 is suffers from a Weak Password Recovery...
Critical
9.8
CVE-2022-26635
PHP-Memcached v2.2.0 and below contains an improper NULL termination which...
Critical
9.8
CVE-2021-32610
In Archive_Tar before 1.4.14, symlinks can refer to targets outside...
High
7.1
CVE-2020-36193
Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory...
Unknown
0
Affected Vendor
Affected Software
php
Vulnerable Versions:
5.3.0, 5.4.0
Timeline
Official Publish:
July 13th, 2013
Last Modified:
August 6th, 2024
Added to House:
July 19th, 2026
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.