CVE-2011-4885

Published: Dec 30, 2011Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

Affected (45)

Products: Php: Php

1 product

Configuration A

45 vulnerable

Vulnerable Software	Affected Versions
Php Php	Up to 5.3.8
Php Php	Version 5.0.0
Php Php	Version 5.0.0 beta1
Php Php	Version 5.0.0 beta2
Php Php	Version 5.0.0 beta3
Php Php	Version 5.0.0 beta4
Php Php	Version 5.0.0 rc1
Php Php	Version 5.0.0 rc2
Php Php	Version 5.0.0 rc3
Php Php	Version 5.0.1
Php Php	Version 5.0.2
Php Php	Version 5.0.3
Php Php	Version 5.0.4
Php Php	Version 5.0.5
Php Php	Version 5.1.1
Php Php	Version 5.1.2
Php Php	Version 5.1.3
Php Php	Version 5.1.4
Php Php	Version 5.1.5
Php Php	Version 5.1.6
Php Php	Version 5.2.0
Php Php	Version 5.2.10
Php Php	Version 5.2.11
Php Php	Version 5.2.12
Php Php	Version 5.2.14
Php Php	Version 5.2.15
Php Php	Version 5.2.16
Php Php	Version 5.2.17
Php Php	Version 5.2.1
Php Php	Version 5.2.2
Php Php	Version 5.2.3
Php Php	Version 5.2.4
Php Php	Version 5.2.5
Php Php	Version 5.2.6
Php Php	Version 5.2.7
Php Php	Version 5.2.8
Php Php	Version 5.2.9
Php Php	Version 5.3.0
Php Php	Version 5.3.1
Php Php	Version 5.3.2
Php Php	Version 5.3.3
Php Php	Version 5.3.4
Php Php	Version 5.3.5
Php Php	Version 5.3.6
Php Php	Version 5.3.7

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (54)

http://archives.neohapsis.com/archives/bugtraq/2011-12/0181.html

Source: cve@mitre.org

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041

Source: cve@mitre.org

http://lists.apple.com/archives/security-announce/2012/May/msg00001.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00013.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00016.html

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=132871655717248&w=2

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=133469208622507&w=2

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2012-0071.html

Source: cve@mitre.org

http://secunia.com/advisories/47404

Source: cve@mitre.org

http://secunia.com/advisories/48668

Source: cve@mitre.org

http://support.apple.com/kb/HT5281

Source: cve@mitre.org

http://svn.php.net/viewvc?view=revision&revision=321003

Source: cve@mitre.org

http://svn.php.net/viewvc?view=revision&revision=321040

Source: cve@mitre.org

http://www.debian.org/security/2012/dsa-2399

Source: cve@mitre.org

http://www.exploit-db.com/exploits/18296

Source: cve@mitre.org

http://www.exploit-db.com/exploits/18305

Source: cve@mitre.org

http://www.kb.cert.org/vuls/id/903934

Source: cve@mitre.org

US Government Resource

http://www.mandriva.com/security/advisories?name=MDVSA-2011:197

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDVSA-2013:150

Source: cve@mitre.org

http://www.nruns.com/_downloads/advisory28122011.pdf

Source: cve@mitre.org

http://www.ocert.org/advisories/ocert-2011-003.html

Source: cve@mitre.org

http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2012-0019.html

Source: cve@mitre.org

http://www.securityfocus.com/bid/51193

Source: cve@mitre.org

http://www.securitytracker.com/id?1026473

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/72021

Source: cve@mitre.org

https://github.com/FireFart/HashCollision-DOS-POC/blob/master/HashtablePOC.py

Source: cve@mitre.org

http://archives.neohapsis.com/archives/bugtraq/2011-12/0181.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.apple.com/archives/security-announce/2012/May/msg00001.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00013.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00016.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://marc.info/?l=bugtraq&m=132871655717248&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

http://marc.info/?l=bugtraq&m=133469208622507&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2012-0071.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/47404

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/48668

Source: af854a3a-2127-422b-91ae-364da2661108

http://support.apple.com/kb/HT5281

Source: af854a3a-2127-422b-91ae-364da2661108

http://svn.php.net/viewvc?view=revision&revision=321003

Source: af854a3a-2127-422b-91ae-364da2661108

http://svn.php.net/viewvc?view=revision&revision=321040

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2012/dsa-2399

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.exploit-db.com/exploits/18296

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.exploit-db.com/exploits/18305

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.kb.cert.org/vuls/id/903934

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

http://www.mandriva.com/security/advisories?name=MDVSA-2011:197

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDVSA-2013:150

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.nruns.com/_downloads/advisory28122011.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ocert.org/advisories/ocert-2011-003.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.redhat.com/support/errata/RHSA-2012-0019.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/51193

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1026473

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/72021

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/FireFart/HashCollision-DOS-POC/blob/master/HashtablePOC.py

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.