CVE-2011-0421

N/A Unknown
Published: March 20, 2011 Modified: April 29, 2026
View on NVD

Description

The _zip_name_locate function in zip_name_locate.c in the Zip extension in PHP before 5.3.6 does not properly handle a ZIPARCHIVE::FL_UNCHANGED argument, which might allow context-dependent attackers to cause a denial of service (NULL pointer dereference) via an empty ZIP archive that is processed with a (1) locateName or (2) statName operation.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
http://bugs.php.net/bug.php?id=53885
Source: cret@cert.org
Exploit
http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html
Source: cret@cert.org
http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057709.html
Source: cret@cert.org
http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057710.html
Source: cret@cert.org
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056642.html
Source: cret@cert.org
http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html
Source: cret@cert.org
http://marc.info/?l=bugtraq&m=133469208622507&w=2
Source: cret@cert.org
http://secunia.com/advisories/43621
Source: cret@cert.org
Vendor Advisory
http://securityreason.com/achievement_securityalert/96
Source: cret@cert.org
http://securityreason.com/securityalert/8146
Source: cret@cert.org
http://support.apple.com/kb/HT5002
Source: cret@cert.org
http://svn.php.net/viewvc/?view=revision&revision=307867
Source: cret@cert.org
Patch
http://www.debian.org/security/2011/dsa-2266
Source: cret@cert.org
http://www.exploit-db.com/exploits/17004
Source: cret@cert.org
Exploit
http://www.mandriva.com/security/advisories?name=MDVSA-2011:052
Source: cret@cert.org
http://www.mandriva.com/security/advisories?name=MDVSA-2011:053
Source: cret@cert.org
http://www.mandriva.com/security/advisories?name=MDVSA-2011:099
Source: cret@cert.org
http://www.php.net/ChangeLog-5.php
Source: cret@cert.org
http://www.php.net/archive/2011.php
Source: cret@cert.org
http://www.php.net/releases/5_3_6.php
Source: cret@cert.org
http://www.securityfocus.com/archive/1/517065/100/0/threaded
Source: cret@cert.org
http://www.securityfocus.com/bid/46354
Source: cret@cert.org
http://www.vupen.com/english/advisories/2011/0744
Source: cret@cert.org
Vendor Advisory
http://www.vupen.com/english/advisories/2011/0764
Source: cret@cert.org
Vendor Advisory
http://www.vupen.com/english/advisories/2011/0890
Source: cret@cert.org
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=688735
Source: cret@cert.org
Exploit Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/66173
Source: cret@cert.org
http://bugs.php.net/bug.php?id=53885
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit
http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html
Source: af854a3a-2127-422b-91ae-364da2661108
http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057709.html
Source: af854a3a-2127-422b-91ae-364da2661108
http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057710.html
Source: af854a3a-2127-422b-91ae-364da2661108
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056642.html
Source: af854a3a-2127-422b-91ae-364da2661108
http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html
Source: af854a3a-2127-422b-91ae-364da2661108
http://marc.info/?l=bugtraq&m=133469208622507&w=2
Source: af854a3a-2127-422b-91ae-364da2661108
http://secunia.com/advisories/43621
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
http://securityreason.com/achievement_securityalert/96
Source: af854a3a-2127-422b-91ae-364da2661108
http://securityreason.com/securityalert/8146
Source: af854a3a-2127-422b-91ae-364da2661108
http://support.apple.com/kb/HT5002
Source: af854a3a-2127-422b-91ae-364da2661108
http://svn.php.net/viewvc/?view=revision&revision=307867
Source: af854a3a-2127-422b-91ae-364da2661108
Patch
http://www.debian.org/security/2011/dsa-2266
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.exploit-db.com/exploits/17004
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit
http://www.mandriva.com/security/advisories?name=MDVSA-2011:052
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.mandriva.com/security/advisories?name=MDVSA-2011:053
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.mandriva.com/security/advisories?name=MDVSA-2011:099
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.php.net/ChangeLog-5.php
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.php.net/archive/2011.php
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.php.net/releases/5_3_6.php
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.securityfocus.com/archive/1/517065/100/0/threaded
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.securityfocus.com/bid/46354
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.vupen.com/english/advisories/2011/0744
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
http://www.vupen.com/english/advisories/2011/0764
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
http://www.vupen.com/english/advisories/2011/0890
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=688735
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/66173
Source: af854a3a-2127-422b-91ae-364da2661108

54 reference(s) from NVD

Quick Stats

CVSS v3 Score
N/A / 10.0
EPSS (Exploit Probability)
13.5%
96th percentile
Exploitation Status
Not in CISA KEV

Affected Vendors

php