CVE-2012-2386
Priority
Medium
Description
Integer overflow in the phar_parse_tarfile function in tar.c in the phar
extension in PHP before 5.3.14 and 5.4.x before 5.4.4 allows remote
attackers to cause a denial of service (application crash) or possibly
execute arbitrary code via a crafted tar file that triggers a heap-based
buffer overflow.
extension in PHP before 5.3.14 and 5.4.x before 5.4.4 allows remote
attackers to cause a denial of service (application crash) or possibly
execute arbitrary code via a crafted tar file that triggers a heap-based
buffer overflow.
References
Assigned-to
mdeslaur
Package
| Upstream: | released (5.4.4~rc1-1) |
| Ubuntu 8.04 LTS (Hardy Heron): | not-affected (code not present) |
| Ubuntu 10.04 LTS (Lucid Lynx): | released (5.3.2-1ubuntu4.17) |
| Ubuntu 11.04 (Natty Narwhal): | released (5.3.5-1ubuntu7.10) |
| Ubuntu 11.10 (Oneiric Ocelot): | released (5.3.6-13ubuntu3.8) |
| Ubuntu 12.04 LTS (Precise Pangolin): | released (5.3.10-1ubuntu3.2) |
| Ubuntu 12.10 (Quantal Quetzal): | not-affected (5.4.4-1ubuntu1) |
Patches: