Explain CVE-2011-1153
Multiple format string vulnerabilities in phar_object.c in the phar extension in PHP 5.3.5 and earlier allow context-dependent attackers to obtain sensitive information from process memory, cause a denial of service (memory corruption), or possibly execute arbitrary code via format string specifiers in an argument to a class method, leading to an incorrect zend_throw_exception_ex call.
Affected Products: n/a
References: [{'name': '46854', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/46854'}, {'name': 'php-pharobject-format-string(66079)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/66079'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=688378'}, {'name': '43744', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43744'}, {'name': 'FEDORA-2011-3636', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057709.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://svn.php.net/viewvc?view=revision&revision=309221'}, {'name': 'ADV-2011-0764', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0764'}, {'name': 'FEDORA-2011-3614', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056642.html'}, {'name': '[oss-security] 20110314 CVE request: format-string vulnerability in PHP Phar extension', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/03/14/13'}, {'name': '[oss-security] 20110314 Re: CVE request: format-string vulnerability in PHP Phar extension', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/03/14/14'}, {'name': 'MDVSA-2011:053', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2011:053'}, {'name': 'DSA-2266', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2011/dsa-2266'}, {'name': 'ADV-2011-0890', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0890'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.php.net/releases/5_3_6.php'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.php.net/bug.php?id=54247'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.php.net/ChangeLog-5.php'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.php.net/archive/2011.php'}, {'name': 'APPLE-SA-2011-10-12-3', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html'}, {'name': 'FEDORA-2011-3666', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057710.html'}, {'name': 'MDVSA-2011:052', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2011:052'}, {'name': '[oss-security] 20110314 Re: CVE request: format-string vulnerability in PHP Phar extension', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2011/03/14/24'}, {'name': 'ADV-2011-0744', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0744'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT5002'}]
CVE State: PUBLISHED