CVE-2012-6113

Published: Jan 19, 2013Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The openssl_encrypt function in ext/openssl/openssl.c in PHP 5.3.9 through 5.3.13 does not initialize a certain variable, which allows remote attackers to obtain sensitive information from process memory by providing zero bytes of input data.

Affected (5)

Products: Php: Php

Php

1 product

Php

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Php Php	Version 5.3.10
Php Php	Version 5.3.11
Php Php	Version 5.3.12
Php Php	Version 5.3.13
Php Php	Version 5.3.9

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (10)

http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=270a406ac94b5fc5cc9ef59fc61e3b4b95648a3e

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2013/01/18/6

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-1702-1

Source: secalert@redhat.com

https://bugs.launchpad.net/ubuntu/+source/php5/+bug/1099793

Source: secalert@redhat.com

https://bugs.php.net/bug.php?id=61413

Source: secalert@redhat.com

http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=270a406ac94b5fc5cc9ef59fc61e3b4b95648a3e