CVE-2013-4248

The openssl_x509_parse function in openssl.c in the OpenSSL module in PHP before 5.4.18 and 5.5.x before 5.5.2 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
References
Link Resource
http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=2874696a5a8d46639d261571f915c493cd875897
http://lists.opensuse.org/opensuse-updates/2013-12/msg00125.html
http://lists.opensuse.org/opensuse-updates/2013-12/msg00126.html
http://marc.info/?l=bugtraq&m=141390017113542&w=2
http://rhn.redhat.com/errata/RHSA-2013-1307.html Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1615.html
http://secunia.com/advisories/54478 Vendor Advisory
http://secunia.com/advisories/54657 Vendor Advisory
http://secunia.com/advisories/55078 Vendor Advisory
http://secunia.com/advisories/59652
http://support.apple.com/kb/HT6150
http://www.debian.org/security/2013/dsa-2742
http://www.php.net/ChangeLog-5.php
http://www.securityfocus.com/bid/61776
http://www.securitytracker.com/id/1028924
http://www.ubuntu.com/usn/USN-1937-1 Vendor Advisory
http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=2874696a5a8d46639d261571f915c493cd875897
http://lists.opensuse.org/opensuse-updates/2013-12/msg00125.html
http://lists.opensuse.org/opensuse-updates/2013-12/msg00126.html
http://marc.info/?l=bugtraq&m=141390017113542&w=2
http://rhn.redhat.com/errata/RHSA-2013-1307.html Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1615.html
http://secunia.com/advisories/54478 Vendor Advisory
http://secunia.com/advisories/54657 Vendor Advisory
http://secunia.com/advisories/55078 Vendor Advisory
http://secunia.com/advisories/59652
http://support.apple.com/kb/HT6150
http://www.debian.org/security/2013/dsa-2742
http://www.php.net/ChangeLog-5.php
http://www.securityfocus.com/bid/61776
http://www.securitytracker.com/id/1028924
http://www.ubuntu.com/usn/USN-1937-1 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:10.04:-:lts:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.0.0:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.0.0:beta1:*:*:*:*:*:*
cpe:2.3:a:php:php:5.0.0:beta2:*:*:*:*:*:*
cpe:2.3:a:php:php:5.0.0:beta3:*:*:*:*:*:*
cpe:2.3:a:php:php:5.0.0:beta4:*:*:*:*:*:*
cpe:2.3:a:php:php:5.0.0:rc1:*:*:*:*:*:*
cpe:2.3:a:php:php:5.0.0:rc2:*:*:*:*:*:*
cpe:2.3:a:php:php:5.0.0:rc3:*:*:*:*:*:*
cpe:2.3:a:php:php:5.0.1:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.0.2:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.0.3:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.0.4:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.0.5:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.1.0:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.1.1:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.1.2:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.1.3:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.1.4:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.1.5:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.1.6:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.0:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.1:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.2:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.3:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.4:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.5:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.6:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.7:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.8:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.9:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.10:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.11:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.12:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.13:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.14:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.15:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.16:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.17:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.3.0:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.3.1:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.3.2:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.3.3:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.3.4:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.3.5:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.3.6:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.3.7:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.3.8:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.3.9:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.3.10:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.3.11:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.3.12:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.3.13:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.3.14:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.3.15:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.3.16:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.3.17:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.3.18:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.3.19:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.3.20:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.3.21:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.3.22:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.3.23:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.3.24:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.3.25:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.3.26:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.3.27:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.4.0:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.4.1:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.4.2:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.4.3:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.4.4:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.4.5:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.4.6:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.4.7:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.4.8:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.4.9:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.4.10:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.4.11:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.4.12:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.4.12:rc1:*:*:*:*:*:*
cpe:2.3:a:php:php:5.4.12:rc2:*:*:*:*:*:*
cpe:2.3:a:php:php:5.4.13:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.4.13:rc1:*:*:*:*:*:*
cpe:2.3:a:php:php:5.4.14:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.4.14:rc1:*:*:*:*:*:*
cpe:2.3:a:php:php:5.4.15:rc1:*:*:*:*:*:*
cpe:2.3:a:php:php:5.4.16:rc1:*:*:*:*:*:*
cpe:2.3:a:php:php:5.5.0:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.5.1:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:o:redhat:enterprise_linux:5:*:*:*:*:*:*:*

History

21 Nov 2024, 01:55

Type Values Removed Values Added
References () http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=2874696a5a8d46639d261571f915c493cd875897 - () http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=2874696a5a8d46639d261571f915c493cd875897 -
References () http://lists.opensuse.org/opensuse-updates/2013-12/msg00125.html - () http://lists.opensuse.org/opensuse-updates/2013-12/msg00125.html -
References () http://lists.opensuse.org/opensuse-updates/2013-12/msg00126.html - () http://lists.opensuse.org/opensuse-updates/2013-12/msg00126.html -
References () http://marc.info/?l=bugtraq&m=141390017113542&w=2 - () http://marc.info/?l=bugtraq&m=141390017113542&w=2 -
References () http://rhn.redhat.com/errata/RHSA-2013-1307.html - Vendor Advisory () http://rhn.redhat.com/errata/RHSA-2013-1307.html - Vendor Advisory
References () http://rhn.redhat.com/errata/RHSA-2013-1615.html - () http://rhn.redhat.com/errata/RHSA-2013-1615.html -
References () http://secunia.com/advisories/54478 - Vendor Advisory () http://secunia.com/advisories/54478 - Vendor Advisory
References () http://secunia.com/advisories/54657 - Vendor Advisory () http://secunia.com/advisories/54657 - Vendor Advisory
References () http://secunia.com/advisories/55078 - Vendor Advisory () http://secunia.com/advisories/55078 - Vendor Advisory
References () http://secunia.com/advisories/59652 - () http://secunia.com/advisories/59652 -
References () http://support.apple.com/kb/HT6150 - () http://support.apple.com/kb/HT6150 -
References () http://www.debian.org/security/2013/dsa-2742 - () http://www.debian.org/security/2013/dsa-2742 -
References () http://www.php.net/ChangeLog-5.php - () http://www.php.net/ChangeLog-5.php -
References () http://www.securityfocus.com/bid/61776 - () http://www.securityfocus.com/bid/61776 -
References () http://www.securitytracker.com/id/1028924 - () http://www.securitytracker.com/id/1028924 -
References () http://www.ubuntu.com/usn/USN-1937-1 - Vendor Advisory () http://www.ubuntu.com/usn/USN-1937-1 - Vendor Advisory

07 Nov 2023, 02:16

Type Values Removed Values Added
References
  • {'url': 'http://git.php.net/?p=php-src.git;a=commit;h=2874696a5a8d46639d261571f915c493cd875897', 'name': 'http://git.php.net/?p=php-src.git;a=commit;h=2874696a5a8d46639d261571f915c493cd875897', 'tags': [], 'refsource': 'CONFIRM'}
  • () http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=2874696a5a8d46639d261571f915c493cd875897 -

Information

Published : 2013-08-18 02:52

Updated : 2024-11-21 01:55


NVD link : CVE-2013-4248

Mitre link : CVE-2013-4248

CVE.ORG link : CVE-2013-4248


JSON object : View

Products Affected

canonical

  • ubuntu_linux

php

  • php

redhat

  • enterprise_linux
CWE
CWE-20

Improper Input Validation