Information disclosure in PHP - CVE-2010-1915

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The preg_quote function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature, modification of ZVALs whose values are not updated in the associated local variables, and access of previously-freed memory.

Affected software

How to mitigate CVE-2010-1915

External References

• http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html
• http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00000.html
• http://www.php-security.org/2010/05/09/mops-2010-017-php-preg_quote-interruption-information-leak-vulnerability/index.html
• https://exchange.xforce.ibmcloud.com/vulnerabilities/58586

Related Security Bulletins

• Multiple vulnerabilities in PHP
• Gentoo update for PHP